Re: [Tails-dev] Package Tor Monitor

Hi Clement,

[…]
> I just I a look at it, and I was wondering : the pot file gets generated
> at build time, so it would'nt be reproducible without some patches to
> the build system (change date of potfile generation for the last
> changelog entry's, or maybe change the upstream work to generate it
> along with the tarball, and bypass this at debian build time).

Indeed. If it’s just the 'POT-Creation-Date’ entry, wouldn’t it suffice to use faketime? That’s how I made some of my packages with autogenerated PDF manuals build reproducibly, which show a similar timestamp problem.
Having upstream generate these separate from the build process would of course be cleaner and preferable.

For the time being, I have faketimed the build to the last changelog date and time. See my github repo.

> Maybe we should do something like OpenPGP Applet : create a full
> upstream project on alioth to hosts tarball, upstream changelog etc, and
> then use this as a basis for debian package (with a separate repository
> for debian packaging like suggested before) ?

Hmm, this would make it possible to create a proper watchfile — the cgit installation on git.tails.boum.org seems to have snapshot tarball creation for tags deactivated.

Cheers
Sascha