timestamps_from_cpp_macros:
  description: |
    The C pre-processor macros `__DATE__`, `__TIME__`,
    capture the current time, and thus will obviously make a build
    unreproducible.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsFromCPPMacros
  deterministic: True
timestamps_from_timestamp_macro:
  description: |
    The `__TIMESTAMP__` macro captures the file modification time, which
    should be deterministic (if the file is not modified at build time),
    but varies (at least with gcc) with timezone.
  deterministic: True
timestamps_from_cpp_macros_in_d:
  description: |
    The D compiler also support C-like `__DATE__` and `__TIME__` macros, which
    embed the build time/date into the object files.
  deterministic: True
timestamps_from_cpp_macros_in_haskell:
  description: |
    The Haskell compiler also support C-like `__DATE__` and `__TIME__` macros, which
    embed the build time/date into the object files.
    .
    eg. https://sources.debian.net/src/darcs/latest/darcs/darcs.hs/#L85
  deterministic: True
timestamps_in_cpio_archive:
  description: |
    cpio archives capture build time in mtime of its members.
    Workaround: Set mtimes on disk before creating cpio archive
  deterministic: True
timestamps_in_h_generated_by_qdbusxml2cpp:
  description: |
    qdbusxml2cpp uses a timestamp for its anti-double-inclusion
    definition in C header it generates.
    e.g. '#define QUERYINTERFACE_H_1425457739'
  deterministic: True
timestamps_in_h_generated_by_ecbuild:
  description: |
    ecbuild generates a PACKAGE_ecbuild_config.h that embeds the
    build time.
    https://sources.debian.org/src/ecbuild/3.7.1-1/cmake/ecbuild_config.h.in/#L35
timestamps_in_documentation_generated_by_phpdox:
  description: |
    phpdox adds a timestamp in manpages it generates (id="buildinfo")
    .
    /usr/share/php/TheSeer/phpDox/generator/enricher/build/Build.php ?
nondeterminstic_todo_identifiers_in_documentation_generated_by_doxygen:
  description: |
    eg. '<a class="anchor" id="_todo000056"> vs <a class="anchor" id="_todo000058">'
build_path_identifiers_in_documentation_generated_by_doxygen:
  description: |
    e.g. '<a·class="anchor"·id="md__build_1st_opencc_1_1_3_ds1_README">'
    vs. '<a·class="anchor"·id="md__build_2_opencc_1_1_3_ds1_2nd_README">'
timestamps_in_documentation_generated_by_doxygen:
  description: |
    If Doxyfile contains HTML_TIMESTAMP = YES, Doxygen will add a
    timestamp to its generated documentation.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDocumentationGeneratedByDoxygen
  deterministic: True
timestamps_in_manpages_generated_by_doxygen:
  description: |
    Doxygen uses timestamp in manpages it generates
    https://bugs.debian.org/785624
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInManpagesGeneratedByDoxygen
  deterministic: True
year_variable_in_documentation_generated_by_doxygen:
  description: |
    Doxygen docs can use $year which uses the current year, not one based on
    SOURCE_DATE_EPOCH.
  url: https://bugs.debian.org/863054
  deterministic: True
build_dir_in_documentation_generated_by_doxygen:
  description: |
    If FULL_PATH_NAMES = YES, doxygen will include a build path into the
    documentation based on dirname(1). (Can also include it via other means,
    including generating SVG images with build paths)
build_dir_in_tags_generated_by_doxygen:
  description: |
    Even if FULL_PATH_NAMES = NO, doxygen will include a build path into the
    "tags" files.
absolute_build_dir_in_docs_generated_by_doxygen_ref:
  description: |
    Links to sources link to (eg. /build/1st)
  url: https://github.com/doxygen/doxygen/issues/8037
nondeterministic_ordering_in_documentation_generated_by_doxygen:
  description: |
    "Additional Inherited Members" has nondeterministic children in the (HTML?)
    docs.
    .
    This can also happen when there is a real C function and a hash-define with
    the same name. Doxygen sorts the member names but it only appears to use
    the name so it is not stable relative to their type, resulting in
    nondeterministic output.
    .
    MemberNameSDict::compareValues in doxygen's membername.cpp is suspicious.
nondeterministic_ordering_in_todo_items_collected_by_doxygen:
  description:
    A subset of nondeterministic_ordering_in_documentation_generated_by_doxygen
    but limited to \todo entries.
nondeterministic_ordering_in_deprecated_items_collected_by_doxygen:
  description:
    A subset of nondeterministic_ordering_in_documentation_generated_by_doxygen
    but limited to entries annotated by @deprecated.
nondeterministic_ordering_in_guile_binaries:
  description: |
    The ordering of various procedures in guile .go files can vary
    when built in parallel. Can be worked around by disabling
    parallelism in the build process.
    .
    Symtoms may include wrapXXX-procedures with different numbering
    and/or a reference to SOMEFILE.scm present in one build but not
    the other.
    .
    https://bugs.debian.org/995092
    https://github.com/NixOS/nixpkgs/pull/78778
    https://issues.guix.gnu.org/issue/20272
    https://build.opensuse.org/request/show/732638
nondeterministic_versioned_dependency_on_libadns:
  description: |
    Non-deterministically gets a different versioned dependency on
    libadns1·(>=·1.5.0~0) vs. libadns1·(>=·1.5.0~), which are actually
    equivalent.
build_path_in_include_graphs_generated_by_doxygen:
  description: |
    INCLUDE_GRAPHS generates a PNG (or similar) to represent the dependencies
    between header files. However, these can include the full path of some
    header files.
build_path_used_to_determine_version_or_package_name:
  description: |
    The package assumes to be build in a PACKAGE-VERSION directory to
    parse version and/or package name information.
    .
    For packages using python-param, see
    nondeterministic_version_generated_by_python_param.
timestamps_in_manpages_generated_by_yat2m:
  description: |
    yat2m adds a timestamp in manpages it generates.
  deterministic: True
timestamps_in_manpages_generated_by_perl_extutils_command_mm:
  description: |
    ExtUtils::Command::MM adds current time, eg.
    .
    =head2 Sat Aug 13 11:14:56 2016: C<Module> L<RT::Extension::Spa
  url: https://bugs.debian.org/834190
timestamps_in_perllocal_pod_manpages_generated_by_perl_extutils_mm_unix:
  description: |
    ExtUtils::MM_Unix adds current time, eg.
    .
    =head2 Thu Sep  7 13:51:59 2017: C<Module> L<RT::Extension::Cust
  url: https://bugs.debian.org/835815
timestamps_in_documentation_generated_by_naturaldocs:
  description: |
    naturaldocs uses today's date
  url: https://bugs.debian.org/831377
  deterministic: True
timestamps_in_documentation_generated_by_asciidoc:
  description: |
    asciidoc adds a timestamp at the end of a generated HTML file.
    This timestamp is based on the date of the file but it can change depending on the TZ environment variable.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDocumentationGeneratedByAsciidoc
  deterministic: True
timestamps_in_documentation_generated_by_man2html:
  description: |
    man2html adds a timestamp at the end of a generated HTML file.
    Patch at https://bugs.debian.org/796130 applied to our repo.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDocumentationGeneratedByMan2Html
  deterministic: True
timestamps_in_dvi_generated_by_latex:
  description: |
    The creation date of the DVI file is the current time.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDviGeneratedByLaTeX
  deterministic: True
timestamps_in_ps_generated_by_dvips:
  description: |
    eg. %%CreationDate (or DVIPSSource?) in header
    .
    https://sources.debian.net/src/texlive-bin/latest/texk/web2c/pdftexdir/pdftex.web/#L14449
    .
    DVIPSSource date Can be set to SOURCE_DATE_EPOCH by setting FORCE_SOURCE_DATE to 1.
  deterministic: True
blacklisted_on_jenkins:
  description: |
    Some packages have been blacklisted in our test infrastructure because
    their build hangs, takes too long, spawns processes that are not killed, or
    simply because they use too many resources for our current capacity. (This
    is purely practical step - we would like to test these packages.)
blacklisted_on_jenkins_armhf_only:
  description: |
    Some packages have been blacklisted only on armhf in our test infrastructure 
    because their builds take too long on the tiny armhf boards we're using.
    The mitigation against this is to add more architectures or to wait until
    we test against the debian archive, when it will become sensible to raise
    the 18h timeout for a single build.
    Until his happens, please rely on the amd64, i386 and arm64 tests.
diffoscope_runs_forever:
  url: https://reproducible.debian.net/index_breakages.html
  description: |
    Some packages cannot be analysed by diffoscope due to it running "forever".
    Currently the diffoscope process is killed after 120 minutes.
    https://reproducible.debian.net/index_breakages.html collects a list of currently 
    undiffable packages (as well as other issues with tests.reproducile-builds.org.
timestamps_in_maven_version_files:
  description: |
    Maven writes a timestamp to version.properties files.
  deterministic: True
timestamps_in_maven_metadata_local_xml_files:
  description: |
    Maven writes a timestamp to maven-metadata-local.xml files.
  deterministic: True
locale_differences_in_pom:
  description: |
    Some tool is writing .pom files with randomly ordered data.
  deterministic: True
timestamps_in_pe_binaries:
  description: |
    PE binaries contain a timestamp and maybe randomness in an UUID.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInPEBinaries
  deterministic: True
randomness_in_documentation_generated_by_scilab:
  description: |
    Whilst this looks like randomness in section_XXXX links, I believe this is
    actually generated by the build system capturing the entire build path
    .
     <span·class="top"><a·href="section_be5547c931fe4d46ae907fad928a7cc2.html">ANN·toolbox</a></span>
    .
    Source is likely https://sources.debian.net/src/scilab/latest/modules/helptools/macros/xmltoformat.sci/#L1569
randomness_in_documentation_generated_by_epydoc:
  description: |
    Epydoc will add timestamps to the HTML file it produces. It can also generates
    different class index depending on filesystem ordering. It might also output
    references to object with a memory address.
    Related bugs:
        https://bugs.debian.org/827416
  url: https://wiki.debian.org/ReproducibleBuilds/EpydocIssues
timestamps_in_python_code_generated_by_cheetah:
  description: |
    Cheetah embeds two timestamps into generated Python code by default.
    This can be disabled with a compiler flag.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInPythonCodeGeneratedByCheetah
  deterministic: True
random_order_in_python_environment_pickle:
  description: |
    Python doctrees writes a `environment.pickle.gz`, in a random order and embeds encoding in some `*.doctree.gz` files.
locale_dependent_order_in_devlibs_depends:
  url: https://bugs.debian.org/796330
  description: |
    devlibs:Depends is sorted in a locale-dependent way.
  deterministic: True
fontforge_resets_modification_time:
  description: |
    When a fontforge script is used, if the font loaded is modified
    in any way, then the font modification time is set to the current
    time.
    .
    Initial patch in https://bugs.debian.org/774274 but withdrawn after
    SOURCE_DATE_EPOCH proposal.
    .
    WIP patch at https://gist.githubusercontent.com/lamby/60a545b37b778e148702c342bbf86bd9/raw/19a39af51d669fde042b261236f65ba72f75662a/903_reproducubile_build.diff
    .
    Related upstream bug at https://github.com/fontforge/fontforge/issues/2490
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInFontsGeneratedWithFontForge
  deterministic: True
build_time_embedded_by_fontforge:
  description: |
    When a fontforge script is used, it can appear to use the current build
    time in embedded metadata in a field (not the "modification time").
varying_mtimes_in_data_tar_gz_or_control_tar_gz:
  description: |
    We currently adjust the file mtimes in dh_builddeb. Packages which
    calls `dpkg --build` directly should have a prior call to:
    `export SOURCE_DATE_EPOCH = $(shell date -d "$$(dpkg-parsechangelog --count 1 -SDate)" +%s)`
    and
    `find debian/tmp -newermt "@$$SOURCE_DATE_EPOCH" -print0 | \
         xargs -0r touch --no-dereference --date="@$$SOURCE_DATE_EPOCH"`
    Another option is to convert the build system to `dh`.
  url: https://wiki.debian.org/ReproducibleBuilds/Howto#Members_of_control.tar_and_data.tar_have_varying_mtimes
  deterministic: True
timestamps_in_gzip_headers:
  description: |
    gzip stores a timestamp by default in its header.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInGzipHeaders
  deterministic: True
timestamps_in_png:
  description: |
    PNG can capture build time with the tIME chunk or custom keywords.
    These timestamps are currently removed by strip-nondeterminism, so are not visible to diffoscope anymore. Yet fixing the root cause would be nice.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInPNG
  deterministic: True
timestamps_in_static_libraries:
  description: |
    .a files are ar archives. Since binutils 2.25-6 they should be deterministic
    by default, but there are some remaining buggy corner cases - see
    bug #843210 for example if the package uses binutils-multiarch.
    (#843210 has been fixed in sid now, hopefully this issue becomes moot now.)
    .
    #978494 filed with patch for binutils-arm-none-eabi.
    #996184 filed with patch for bintuils-or1k-elf.
    .
    Other tools that create ar archives directly should in theory be covered by
    strip-nondeterminism, but it is still good to patch them.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInStaticLibraries
  deterministic: True
timestamps_in_tarball:
  description: |
    Tarballs capture build time in mtime of its members.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInTarball
  deterministic: True
random_order_in_tarball:
  description: |
    The order of members inside the tarball varies.
  url: https://wiki.debian.org/ReproducibleBuilds/FileOrderInTarballs
timestamps_in_documentation_generated_by_javadoc:
  description: |
    javadoc will add timestamps to the HTML file it produces.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDocumentationGeneratedByJavadoc
  deterministic: True
random_order_in_documentation_generated_by_javadoc:
  description: |
    Some entries inside individual "class-use" documentation pages are emitted in different orders.
    This appears to only happen with multi-module maven projects, i.e. possibly during
    `mvn javadoc:aggregate`.
    .
    In `jacoco`, you can observe files are generated consistently in the individual submodule
    documentation folders, but then differently when aggregated. Maybe a coincidence.
    .
    Historically, there were some other issues. These have disappeared, but it's not clear why.
    The major version of OpenJDK has changed since these issues were reported (was 7, now 8),
    although the code that was believed to be at fault remains unchanged. These are detailed below.
    .
    The `package-tree.html` file generated by javadoc used to contain an unsorted index.
    .
    Perhaps caused by packageFiles is a Map<String, List<JavaFileObject>> in
    openjdk-7-jdk -> ./langtools.tar.bz2 ->
    src/share/classes/com/sun/tools/javadoc/JavadocTool.java
    .
    There was also a locale-specific wrapping issue, which has disappeared.
    This may be because enough things are using javahelper, which sets the locale.
    .
    Likely cause is
    jdk9_dev/langtools/src/jdk.javadoc/share/classes/com/sun/tools/javadoc/DocLocale.java +172
    .
    Workaround is
    https://sources.debian.net/src/maven-debian-helper/latest/share/cdbs/1/class/maven.mk/?hl=136#L136
nondeterministic_java_bytecode:
  description: |
    Source unknown.
test_suite_logs:
  description: |
    Package embeds test suite logs, which may include a variety of
    issues such as timestamps, timing information, kernel, username,
    hostname, etc.
timestamps_in_documentation_generated_by_groovydoc:
  description: |
    Groovydoc will add timestamps to the HTML file it produces.
    https://sources.debian.net/src/groovy/latest/src/main/org/codehaus/groovy/tools/groovydoc/gstringTemplates/topLevel/index-all.html/#L19
  deterministic: True
timestamps_in_jar:
  description: |
    jar (Java Archive) file stores mtimes. Most often of files generated during
    the build.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInJarFiles
  deterministic: True
timestamps_in_zip:
  description: |
    Zip archives stores mtimes. Most often of files generated during
    the build.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInZip
  deterministic: True
timestamps_difference_by_unzip:
  description: |
    Timestamps in files processed by zip/unzip have timezone variations.
    Setting TZ=UTC before calling zip/unzip the file can fix this.
  deterministic: True
timestamps_in_documentation_generated_by_groff:
  description: |
    groff will add a timestamps to documentation it produces.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDocumentationGeneratedByGroff
  deterministic: True
timestamps_in_pdf_generated_by_latex:
  description: |
    PDF files generated with pdftex and pdflatex will contain CreationDate and
    ModDate set to the current date and time.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInPDFGeneratedByLaTeX
  deterministic: True
timestamps_in_pdf_generated_by_libreoffice:
  description: |
    eg. libreoffice --headless --convert-to-pdf creates PDF files with
    CreationDate field with the current date, encoded with the current timezone
timestamps_in_documentation_generated_by_htmldoc:
  description: |
    PDF files generated with htmldoc will contain CreationDate set to the current
    date and time.
    Fixed in 1.9.1.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDocumentationGeneratedByHtmldoc
  deterministic: True
timestamps_in_header_or_footer_by_htmldoc_in_documentation:
  description: |
    PDF files generated with htmldoc contain date and time in PDF content if 'd' or 'D' options used in header/footer/tocfooter/tocheader parameters.
    Fixed in 1.9.1.
  deterministic: True
libtool_captures_shell_build-flags_build-path_path-env:
  description: |
    GNU libtool captures SHELL, build path, build flags and PATH environment in script.
  deterministic: True
randomness_in_documentation_generated_by_lua_ldoc:
  description: |
    'see also' is not ordered - see module.see
timestamps_in_documentation_generated_by_lua_ldoc:
  description: |
    lua-ldoc adds build timestamp, varying by the timezone
    https://sources.debian.net/src/lua-ldoc/latest/ldoc/html/ldoc_ltp.lua/?hl=293#L293
    https://sources.debian.net/src/lua-ldoc/latest/ldoc.lua/?hl=784#L784
  deterministic: True
  url: https://bugs.debian.org/820240
random_order_generated_by_stateless_iterators_in_lua:
  description: |
    The stateless iterator in lua uses an arbitrary order (by design)
    A possible work-around is: http://lua-users.org/wiki/SortedIteration
  url: http://www.lua.org/pil/7.3.html
pdf_created_by_ghostscript:
  description: |
    PDF files created by Ghostscript contain timestamps and ids.
  url: https://wiki.debian.org/ReproducibleBuilds/PdfGeneratedByGhostscript
serial_numbers_in_ogg:
  description: |
    Ogg streams must include unique serial numbers. By default oggenc includes
    random serial numbers in the header, which are seeded by the current time
    and the pid.
  url: https://wiki.debian.org/ReproducibleBuilds/OggSerialNumbers
serial_numbers_in_ogg_via_sox:
  description: |
    Ogg streams must include unique serial numbers. By default sox includes
    a random serial number in the header.
  url: https://sources.debian.org/src/sox/latest/src/vorbis.c/#L334
timestamps_in_pdf_generated_by_apache_fop:
  description: |
    PDF files generated with Apache FOP will contain CreationDate and
    ModDate set to the current date and time.
    Partial fix applied https://bugs.debian.org/978499
    Further patch submitted https://bugs.debian.org/983588
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInPDFGeneratedByApacheFOP
timestamps_in_documentation_generated_by_texi2html:
  description: |
    eg. "Created on March 1, 2015 by texi2html 1.82"
    texi2html now supports a specified date via --build-date parameter.
  deterministic: True
randomness_in_html_generated_by_texi2html:
  description: |
    texi2html's output varies, probably because of elements being processed
    in Perl hash order.
  url: https://wiki.debian.org/ReproducibleBuilds/RandomnessInHTMLGeneratedByTexi2html
build_path_in_documentation_generated_by_pdflatex:
  description: |
    Full build paths point to embedded .PDF location in (usually images as they
    are easier to embed this way). "PTEX.FileName" key is the filename as seen by pdfTex.
  deterministic: True
python_wheel_package:
  description: |
    Wheel is embedding timestamps into whl files. The timestamp can be overridden
    by setting the WHEEL_FORCE_TIMESTAMP environment variable to an epoch value.
  url: https://wiki.debian.org/ReproducibleBuilds/PythonWheelPackage
  deterministic: True
filesystem_order_in_java_jar_manifest_mf_include_resource:
  description: |
    Java .jar files written by some tools encode filesystem access ordering in the
    "Include-Resource" MANIFEST.MF header.
    https://github.com/jvm-repo-rebuild/reproducible-central/issues/99
    https://issues.apache.org/jira/browse/FELIX-6602
    https://github.com/apache/felix-dev/pull/208
  url: https://bugs.debian.org/1066045
random_order_in_java_jar_manifest_mf:
  description: |
    Java .jar files written by some tools have a random order in MANIFEST.MF.
user_in_java_jar_manifest:
  description: |
    Java .jar files contain user login in the `Built-By` of `MANIFEST.MF`.
timestamp_in_java_bnd_manifest:
  description: |
    bndtools bnd outputs Bnd-LastModified and other entropy
  deterministic: True
bundle_name_in_java_manifest_mf:
  description: |
    Bundle-Name, Bundle-Symbolic name
built_by-in_java_manifest_mf:
  description: |
    Built-By colon username
implementation_version_in_java_manifest_mf:
  description: |
    Captures build time, build host and kernel version with
    Implementation-Version and Implementation-Vendor in META-INF/MANIFEST.MF
  deterministic: True
timestamps_in_python_docutils:
  description: |
    Python docutils writes timestamps into its generated documentation.
  deterministic: True
random_order_in_files_generated_by_module_build:
  description: |
    Perl files generated with Module::Build contain an unsorted dependency list.
    .
    Fixed in libmodule-build-perl, but not in the module shipped by perl itself.
  url: https://bugs.debian.org/774869
users_and_groups_in_cpio_archive:
  description: |
    cpio archives capture user and group for each of its members.
    Solution: If owner does not matter, create cpio archive with "--owner 0:0"
  deterministic: True
users_and_groups_in_tarball:
  description: |
    Tarballs capture user and group for each of its members.
  url: https://wiki.debian.org/ReproducibleBuilds/UsersAndGroupsInTarballs
  deterministic: True
timestamps_in_emacs_autoloads:
  description: |
    Emacs "autoloads" comments contain a timestamp.
    At least some of these would be resolved by a fix for
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799168
  url: https://bugs.debian.org/824050
  deterministic: True
timestamps_in_ruby_documentation:
  description: |
    Ruby's documentation generator outputs a file called "created.rid", which contains
    the time the documentation was generated.
  deterministic: True
timestamps_in_documentation_generated_by_sphinx:
  description: |
    "Last updated," etc.
  deterministic: True
randomness_in_documentation_generated_by_sphinx:
  description: |
    Sphinx might output references to memory addresses and generate a json index file
    with entries in random order or with non-deterministic values (eg. searchindex.js).
    See https://bugs.debian.org/822197 for memory address issue
    .
    searchindex.js needs sort_keys=True (jsonimpl.py) but the key values vary too.
  url: https://wiki.debian.org/ReproducibleBuilds/SphinxIssues
randomness_in_frozenset_representations_in_sphinx:
  description: |
    frozensets are non-deterministic. fixed upstream, waiting for Debian
    release/upload
  url: https://github.com/sphinx-doc/sphinx/pull/5388
randomness_in_documentation_indices_generated_by_sphinx:
  description: |
    Sphinx can output genindex.html index entries in non-deterministic order.
    .
    There might be other missing sorts or dict key sorting beyond the pull
    request already sent.
  url: https://github.com/sphinx-doc/sphinx/pull/1699
randomness_in_property_annotations_generated_by_sphinx:
  description: |
    visit_desc_annotation in sphinx/writers/html.py (?) causes -- for example -- sets
    to be serialised in a nondeterministic order.
randomness_in_documentation_graphviz_generated_by_sphinx:
  description: |
    html/_images/graphviz-9e71e0f9ba91d0842b51211b676ec4adb7e7afb8.png varies
    on build path.
captures_build_path_in_sphinx_attr_links:
  description: |
    Sphinx docs can contain hyperlinks to other parts of the doc, which include
    part of the build path.
  deterministic: True
captures_environment_in_sphinx_autodoc:
  description: |
    The autodoc extension for Sphinx can dynamically evaluate function signatures,
    and when default values for function parameters include environment context this
    can cause reproducibility failures.
    .
    As a workaround, the autodoc_preserve_defaults setting can be enabled.
      https://www.sphinx-doc.org/en/master/usage/extensions/autodoc.html#confval-autodoc_preserve_defaults
captures_build_path_via_cmake_variables:
  description: |
    Variables such as PROJECT_SOURCE_DIR or PROJECT_BINARY_DIR used in
    CMakeLists.txt contain the absolute build path.
  deterministic: True
randomness_in_icc_colour_profiles:
  description: |
    International Color Consortium .icc colour profiles have some issue.
ppds_compressed_b64:
  description: |
    cups drivers have a field named ppds_compressed_b64 which has some issue.
  url: https://wiki.debian.org/ReproducibleBuilds/CupsPpdsIssues
zope_random_field_order_in_dzproduct:
  description: |
    Random order of entries in /usr/share/zope/Products/$package/.dzproduct generated
    by dh_installzope
    .
    Fixed in zope-debhelper 0.3.16.
  url: https://bugs.debian.org/776619
timestamps_in_files_installed_by_dh_kpatches:
  description: |
    Calls gzip without -n
  url: https://bugs.debian.org/776941
  deterministic: True
randomness_in_dh_cligacpolicy_scripts:
  description: |
    dh_cligacpolicy adds debhelper scripts in a random order
  url: https://bugs.debian.org/777185
needs_internet_access_to_build:
  description: |
    Packages which need to access sites on the internet during build.
timestamps_in_mdl_molfile:
  description: |
    MDL Molfiles (https://en.wikipedia.org/wiki/Chemical_table_file) contain a timestamp.
  deterministic: True
build_id_variation_requiring_further_investigation:
  description: |
    ld adds a Build ID in ELF binaries used to link external debug symbols.
    See https://fedoraproject.org/wiki/Releases/FeatureBuildId#Unique_build_ID for
    the spec.
    The default value is a SHA1 hash over the content of the binary. See
    the `--build-id` option in https://sourceware.org/binutils/docs-2.25/ld/Options.html
    for other behavior.
    Unless a different way to compute Build IDs has been specified, different Build IDs
    are the symptom of different binary content. The actual source of the
    difference might not be visible because the debug symbols might have been stripped
    (and they can contain filenames which can differ if the build path is different).
    There is no general solution for this problem. The source of the variation must
    be tracked and fixed. The issue can come from variations in order of object
    members or objects themselves, different content (e.g. `__DATE__` CPP
    macros or similar), or other interesting things.
timestamps_in_documentation_generated_by_podman:
  description: |
    The module Pod::Man includes timestamps in its embedded manpages:
    https://sources.debian.net/src/perl/latest/cpan/podlators/lib/Pod/Man.pm/?hl=1700#L977
    They should be based on the mtime of the original file.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInManpagesGeneratedByPodMan
  deterministic: True
timezones_manpages_podman:
  description: |
    This issue is similar to timestamps_in_documentation_generated_by_podman.
    The embedded timestamps are not from the actual build time, but instead deterministic ones
    that are only varying because of differing timezones between builds.
  url: https://bugs.debian.org/780259
  deterministic: True
timestamps_in_ada_library_information_files:
  description: |
    Ada Library Information (.ali) files contain the mtime of the Ada source (.ads) files that they index.
    .
    Fixed in gcc >= 7-20170302-1.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInAdaLibraryInformationFiles
  deterministic: False
ftbfs_wdatetime:
  description: |
    FTBFS if dpkg-buildflags contains -Wdate-time.
  deterministic: True
ftbfs_build-indep_not_build_on_some_archs:
  description: |
    These are packages where the build-indep target will fail to build on some archs. As this can be the desired behaviour we add those packages to this issue and have made sure that the build problems found in our infrastructure are not propagated to tracker.debian.org and DDPO.
  deterministic: True
ftbfs_environment:
  description: |
    FTBFS with some unrelated values of the environment variables (lang, timezone, ...)
  deterministic: True
different_pot_creation_date_in_gettext_mo_files:
  description: |
    Gettext .mo files in /usr/share/locale/*/LC_MESSAGES differ in their POT-Creation-Date.
    When using dh, they will be normalized by strip-nondeterminism.
  deterministic: True
  url: https://bugs.debian.org/792687
different_pot_creation_date_in_gettext_po_or_pot_files:
  description: |
    (Note this is not the same as different_pot_creation_date_in_gettext_mo_files.)
    When using dh, .mo files will be normalized by strip-nondeterminism.
  url: https://savannah.gnu.org/bugs/?49654
ftbfs_due_to_jenkins_semaphore_setup:
  description: |
    Something interesting in the Jenkins setup where semaphores could not be used correctly.
    .
    Should not affect any package anymore as /dev/shm has been fixed on all nodes and it's correct mounting is being monitored too.
ftbfs_in_jenkins_setup:
  description: |
    Could be:
    1) jobs that try to bind to localhost ports which are in use by something in the
       jenkins machines. The occupied ports are: 22, 25, 80, 443, 3128, 3129, 4949, 34167
    2) the build tries to access a debian archive over http, which is something
       allowed but pbuilder doesn't support this yet (this should only be interesting
       for debian-installer)
    3) something else, the machine is heavily loaded all the time...
timestamps_in_description_files_generated_by_r-base-dev:
  description: |
    r-base-dev leaves a build timestamp (showing date + time + timezone) in
    the /usr/lib/R/library/*/Description files it generates.
    This is fixable with GNU R >= 3.2.0 from unstable. If your package uses the
    r-cran.mk template in debian/rules you should be fine. If not, see
    https://bugs.debian.org/782764 for reference how to fix your package.
  deterministic: True
timestamps_in_manpages_generated_by_latex2man:
  description: |
    Manpages generated with latex2man can (?) embed the date.
  deterministic: True
timestamps_in_manpages_generated_by_sphinx:
  description: |
    Manpages generated with Sphinx embed the build date.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInManpagesGeneratedBySphinx
  deterministic: True
timestamps_in_manpages_generated_by_txt2man:
  description: |
    Manpages generated with txt2man embed the date.
    .
    Pass "-d $date" to txt2man to force a (reproducible) date.
  url: https://bugs.debian.org/790801
  deterministic: True
timestamps_in_manpages_generated_by_help2man:
  description: |
    Manpages generated with help2man embed the month and year by default.
    This has been fixed in help2man version 1.4.71, released in 2015,
    so typically only occurs when using an embedded copy of help2man.
  url: https://bugs.debian.org/787444
  deterministic: True
timestamps_in_manpages_generated_by_rst2man:
  description: |
    Manpages generated with rst2man embed the date
  url: https://bugs.debian.org/831779
fonts_in_pdf_files:
  description: |
    The internally used names/identifiers of fonts embedded into PDF files varies.
    The order of embedded fonts can also be different.
    .
    The order is only different if the date differs (set by TZ environment
    variable for example). If the date is the same, then the font name
    is reproducible. Difference in hour/minute/second resolution seems
    to be irrelevant.
    .
    The font name occurs in the /BaseFont field and in the /Fontname field.
    The name is of the form XXXXXX+YYY where the XXXXXX part is the one that
    varies and is called the subset_tag. It is generated in
    texk/web2c/pdftexdir/utils.c function make_subset_tag() from an MD5 sum
    over the font glyphs.
random_order_in_maven_plugin_xml:
  description: |
    mvn plugin.xml (-plugin packages) is generated in a random order.
    .
    Should be fixed in 3.3-1.
    https://sources.debian.net/src/maven-plugin-tools/latest/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java/#L167
    https://sources.debian.net/src/maven-plugin-tools/latest/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java/#L166
  url: https://jira.codehaus.org/browse/MPLUGIN-261
timestamps_in_documentation_generated_by_edoc:
  description: |
    The Erlang documentation generator EDoc is embedding timestamps in its documentation.
  deterministic: True
timestamps_in_qhc:
  description: |
    There has been done a lot of reproducible fixes in 5.5.0, so it is worth to
    wait entering this version sid before retrying.
    .
    qhelpgenerator inserts a timestamp into documentation (qhc) files,
    which are sqlite3 databases. The timestamp used now respects
    SOURCE_DATE_EPOCH, but is still affected by timezone.
    .
    https://codesearch.debian.net/search?q=Q_UNLIKELY.*SOURCE_DATE_EPOCH&literal=0  
    .
    sqlite3 databases appear to be reproducible in themselves, but qhelp
    generator is using various file IDs which become non-deterministic due to
    map access. For example
    .
    https://sources.debian.net/src/qt4-x11/latest/tools/assistant/lib/qhelpgenerator.cpp/?hl=742#L742
    .
    I suspect we just need a few sorts (and some time to build qt4-x11...)
    .
    Also
    .
    https://sources.debian.org/src/qttools-opensource-src/latest/src/assistant/help/qhelpcollectionhandler.cpp/?hl=1639#L1639
    .
    debian bug https://bugs.debian.org/875847
    .
    upstream bug https://bugreports.qt.io/browse/QTBUG-62697
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDatabaseGeneratedByQhelpgenerator
  deterministic: True
timestamps_in_java_stapler_files:
  description: |
    Another variation of timestamps_in_maven_version_files where someone's
    used the same properties writer.
  deterministic: True
timestamps_in_gjdoc_properties_files:
  description: |
    Another variation of timestamps_in_maven_version_files where someone's
    used the same doomed properties writer, this time in GNU Gjdoc API Documentation.
  deterministic: True
timestamps_manually_added_needs_further_investigation:
  description: |
    Packages which intentionally add the timestamp to their build or files,
    but aren't obviously using any tool or system which has this as a core issue.
    Interesting because they could be fixed by faketime'ing up the whole system.
  deterministic: True
uid_and_gid_in_jar:
  description: |
    Some tool has managed to write uid and gid as an extended attribute into a jar file.
  deterministic: True
uid_and_gid_in_cmake-generated_pkzip:
  description: |
    cmake has a tar subcommand which cannot normalise uid/gid or omit it from
    created (PKZIP format) archives (this may also apply to other cmake-built
    archives / formats)
  url: https://bugs.debian.org/973845
timestamps_in_qmake_makefiles:
  description: |
    Some -dev packages ship generated qmake makefiles, which contain the generation time.
  deterministic: True
user_hostname_manually_added_requiring_further_investigation:
  description: |
    Packages which intentionally capture the username or hostname into a custom format,
    but aren't obviously using any tool or system which has this as a core issue.
    Interesting because they could be fixed by fixing these things at build time.
  deterministic: True
random_order_in_plexus_components_xml:
  description: |
    Plexus, a Java plugin framework, writes its components.xml in a random order.
timestamps_in_epub:
  description: |
    epub files are zip files, and hence have a timestamp in them.
  deterministic: True
timestamps_in_jsdoc_toolkit_documentation:
  description: |
    JsDoc Toolkit writes the documentation generation time into generated HTML.
  deterministic: True
randomness_in_objects_inv:
  description: |
    Some Python documentation tool writes objects.inv files in a random order.
    .
    There is also a translation issue that is being tracked in sphinxdoc_translations
sphinxdoc_translations:
  description: |
    Sphinxdoc translates some titles based on content of LANGUAGE, etc.
    .
    https://bugs.debian.org/998059
  url: https://github.com/sphinx-doc/sphinx/issues/9778
randomness_in_ocaml_cmti_files:
  description: |
    ocamlc generates .cmti with nondeterministic contents that do not appear to
    be due to build path.
randomness_in_ocaml_custom_executables:
  description: |
    ocamlc -custom generates intermediate files with random names that end
    up in the executable.
  url: https://bugs.debian.org/786913
randomness_in_ocaml_provides:
  description: |
    From dh_ocaml :-
    .
    75 ${ocaml:Provides} substvar which will be replaced by a name of the form
    76 libXXX-ocaml-dev-NNNN, where NNNN is an checksum computed from the interfaces
    77 of the modules provided by the library.
    .
    It may be that fixing randomness_in_ocaml_custom_executables implicitly
    fixes this.
    .
    Seems like this can affect Depends too. eg. labltk
random_order_in_ocaml_include_directories:
  description: |
    (I think) directories listed in ./_tags files ingested by ocamlbuild are
    not sorted, leading to (eg.) "-Ifoo -Ibar" vs "-Ibar -Ifoo" and a
    corresponding (un)ordering in the ocaml load path as revealed by
    ocamlobjinfo. See, for instance src:ocaml-uunf
timestamps_in_documentation_generated_by_ocamldoc:
  description: |
    eg. API listings in locale order
timestamp_in_pear_registry_files:
  description: |
    PEAR registry files are serialized PHP objects that contain a timestamp.
    .
    Registry.php in src:php-pear.
  url: https://bugs.debian.org/750697
  deterministic: True
berkeley_db_variation_requiring_further_investigation:
  description: |
    Berkeley databases are not reproducibly.
    This issue requires further poking to understand way.
    https://github.com/libzhuyin/libzhuyin/issues/7
  url: https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20150302/001188.html
different_due_to_umask:
  description: |
    Files have varying permissions because of different umasks.
  deterministic: True
build_path_in_qdoc:
  description: |
    eg. filepath elements
randomness_in_qdoc:
  description: |
    Non-deterministic order of <tag> and <file> elements in XML. See
    https://sources.debian.net/src/qtbase-opensource-src/latest/src/tools/qdoc/helpprojectwriter.cpp/?hl=630#L787
    etc.
randomness_in_qdoc_page_id:
  description: |
    eg.
    <qtPageIndex>
      <page id="{0f990824-d820-4f11-a82f-790abc23751b}">
    ..etc
timestamps_in_python_version_numbers:
  description: |
    python-setuptools is appending the build date to a Python version number.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInPythonVersionNumbers
  deterministic: True
randomness_in_python_setuptools_requires_txt:
  description: |
    python-setuptools generates requires.txt files with contents in arbitrary
    order.
  url: https://bugs.debian.org/804249
timezone_variance_because_of_automake_mdate:
  description: |
    automake's mdate-sh script pretty-prints the modification time of a file.
    This output can influence further steps in the build process and make it unreproducible.
  url: https://wiki.debian.org/ReproducibleBuilds/TimezoneVarianceBecauseOfAutomakeMdate
  deterministic: True
timestamps_in_dictionaries:
  description: |
    Dictionaries built with dictfmt/dictzip (often called .dict.dz) contain timestamps:
      This file was converted from the original database on:
        $DATE
    dictzip gzip-compresses the dictionary and includes a timestamp in the header.
    .
    Call dictfmt with --without-time to prevent the timestamp in the dictionary.
  url: https://bugs.debian.org/776430
  deterministic: True
timestamps_in_manpages_generated_by_docbook2x:
  description: |
    docbook2x-man embeds the build date into generated manpages.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInManpagesGeneratedByDocbook2x
  deterministic: True
leaks_path_environment_variable:
  description: |
    The environment variable PATH is embedded in the build result.
    Sometimes it's just leaked into some file (so "just" causing reproducibility issues), while sometimes this PATH is also used for building, which might give unexpected and broken results.
timestamps_in_manpages_generated_by_docbook_xsl:
  description: |
    docbook-xsl writes the build date into the header; sometimes driven by asciidoc, sometimes by xsltproc.
    Date change visible on Jenkins due to timezone changes.
  url: https://bugs.debian.org/791815
  deterministic: True
timestamps_in_documentation_generated_by_docbook_dbtimestamp:
  description: |
    dbtimestamp is an entity in docbook that inserts the current time.
  deterministic: True
timestamps_in_documentation_generated_by_rdtool:
  description: |
    RD is a document formatter used for ruby programs. When generating manpages, it embeds the
    current month and year.
    This is currently only detected on the 1st of a month, because we are varying the timezone to span more than a day.
  deterministic: True
  url: https://bugs.debian.org/820144
captures_kernel_version:
  description: |
    Stores the kernel version (uname -a, /proc/version, etc.) output, normally for debugging purposes.
    .
    Sub-issue: captures_kernel_version_via_CMAKE_SYSTEM
  deterministic: True
captures_kernel_variant:
  # this can't be deterministic:True as the clean-notes script doesn't know about
  # architectures and this issue is not visible on amd64.
  description: |
    Similar to captures_kernel_version, but specifically refers to capturing
    x86_64 vs i686. This can (currently) happen when testing the i386
    architecture as we use a 64-bit kernel with a 32-bit Debian userland.
    .
    Notably, we do not use `linux32` to emulate the 32 bit personality when
    running those builds, as normally this hides packages that are making use of
    `uname` to detect the host architecture when they really should not.
timestamps_in_cmake:
  description: |
    Timestamps generated by cmake TIMESTAMP function respect
    SOURCE_DATE_EPOCH, but use the local timezone. In CMakeLists.txt,
    uses of the TIMESTAMP function need to specify the timezone as
    UTC:
    .
    string(TIMESTAMP CURRENT_TIME "%Y-%m-%d" UTC)
    .
    Likely affected packages:
    https://codesearch.debian.net/search?q=string%5C%28TIMESTAMP.*%5B%5EU%5D%5B%5ET%5D%5B%5EC%5D%5C%29&literal=0
timestamps_in_allegro_dat_files:
  description: |
    `.dat` files from the Allegro framework are basically archives. The `dat`
    command line tool will add a DATE property with the file modification time.
    .
    The timestamp is believed to be generated by datedit_ftime2asc().
  deterministic: True
randomness_in_fat_lto_objects:
  description: |
    Objects built with `gcc -flto -ffat-lto-objects` will contain random strings
    in the form of `.gnu.lto_.inline.24c30dabb443e726`. They will change at
    each build.
    Temporary (?) solution: pass the full path of the source as the argument
    to `-frandom-seed`.
  url: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66305
randomness_in_c_files_generated_by_extutils_parsexs:
  description: |
    ExtUtils::ParseXS generates nondeterministic C files (differing order) out of .xs files.
    This leads to differently compiled objects.
    .
    There are some code copies, so we have the following bugs in total-
    https://bugs.debian.org/829295
    https://bugs.debian.org/829296
    .
    Fix is also required in ExtUtils::ParseXS in perl(-modules)
  url: https://bugs.debian.org/829295
timestamps_generated_by_eigenbase_resgen:
  description: |
    XOMGenTask adds timestamps to generated files, see src/org/eigenbase/xom/MetaGenerator.java line 1202.
    ResourceGenTask adds timestamps too but can be avoided using commentstyle with scm-safe value.
  deterministic: True
timestamps_in_documentation_generated_by_ur:
  description: |
    UR::Namespace::Command::Update::Doc in the libur-perl package generates documentation with embedded timestamps.
    .
    See doc_sections() in lib/Command/V1.pm and lib/Command/View/DocMethods.pm in the libur-perl source.
    .
    libur-perl 0.440-2 half-fixes that: only timezone handling is wrong.
    libur-perl 0.440-3 should fix that.
  deterministic: True
timestamps_from_tex4ht:
  description: |
    Tex4ht adds timestamps into the HTML output files.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsFromTex4ht
  deterministic: True
timestamps_from_imake_in_xutils:
  url: https://bugs.debian.org/789964
  description: |
    The imake tool from xutils-dev defines a gzip command without `-n` that is used when compressing font files by other packages
  deterministic: True
snapshot_placeholder_replaced_with_timestamp_in_pom_properties:
  description: |
    pom.xml uses a <version> like 0.1-SNAPSHOT which is then replaced with the
    timestamp in the filename of the finished .jar. For example
    /usr/share/eclipse/dropins/cdt-pkg-config/eclipse/plugins/org.eclipse.cdt.managedbuilder.pkgconfig_0.8.0.201506071017.jar
different_encoding:
  description: |
    Files were built with different encoding (non-UTF-8 vs. UTF-8).
  deterministic: True
ftbfs_uninvestigated_unsatisfiable_dependencies:
  description: |
    Packages which fail to satisfy dependencies.  Some of these (but probably not all that many)
    actually have ftbfs_due_to_virtual_dependencies.
  deterministic: True
timestamps_in_documentation_generated_by_org_mode:
  description: |
    Org-mode adds timestamps (which also vary by TZ). They can be added by
    other tools that call org-mode without obviously doing so, specifically
    elpa-htmlize.
  deterministic: True
timestamps_in_pdf_generated_by_matplotlib:
  description: |
    eg. Creator (matplotlib 1.4.2, http://matplotlib.org)
  deterministic: True
  url: https://bugs.debian.org/827361
randomness_in_svg_generated_by_matplotlib:
  description: |
    The SVG output of matplotlib includes some diagram-internal element ID
    attributes.  Some of these can be made deterministic by configuring the
    `svg.hashsalt` rcParam.
  url: https://github.com/matplotlib/matplotlib/issues/27831
lynx_dump_varies_output_with_locale:
  description: |
    Packages use `lynx -dump in.html > out.txt`, but this varies by locale. See
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770011
  deterministic: True
elinks_dump_varies_output_with_locale:
  description: |
    Packages use `elinks -dump in.html > out.txt`, but this varies by locale.
  deterministic: True
debiandoc_sgml_timestamp:
  description: |
    <date> element in debiandoc-sgml results in build timestamp which
    additionally varies by locale.
    .
    This can be worked around by setting the DEBIANDOC_DATE
    environment variable.
  deterministic: True
docbook2txt_locale:
  description: |
    docbook2txt varies output based on locale, usually with non-ascii chars.
  deterministic: True
xmlto_txt_output_locale_specific:
  description: |
    xmlto "txt" output based on locale.
  deterministic: True
texinfo_mdate_sh_varies_by_timezone:
  description:
    If you use version.texi, mdate-sh will output a TZ-sensitive updated date.
    http://www.delorie.com/gnu/docs/automake/automake_81.html
  deterministic: True
nroff_output_varies_by_locale_or_utf8:
  description:
    .. either in terms of non-ASCII chars and effects on text wrapping
  deterministic: True
collation_order_varies_by_locale:
  description:
    LC_COLLATE (or LC_ALL) causes a variation in the deterministic
    order produced by invocations like ls *.  This can usually be
    fixed with LC_COLLATE=C.UTF-8 or LC_COLLATE=C.
  deterministic: True
random_build_path_by_golang_compiler:
  description: |
    The golang compiler embeds paths with a random component into object files.
    Example:
    DW_AT_name        : (indirect string, offset: 0x1b1): /tmp/go-build175461345/github.com/docker/docker/pkg/term/_obj/tc_linux_cgo.cgo2.c
  url: https://bugs.debian.org/824806
images_in_pdf_generated_by_latex:
  description: |
    pdflatex does not generate reproducible pdfs, when there are more than four pictures and a tableofcontent.
    .
    The workaround so far is to use either optipng to optimize the pngs or switch to jpges.
    .
  url: https://bugs.debian.org/796490
random_order_in_python_doit_completion:
  description: |
    python-doit generates Bash and Zsh completion output in arbitrary order.
    .
    Forwarded upstream https://github.com/pydoit/doit/pull/100
  url: https://bugs.debian.org/797180
random_order_in_ibus_table_createdb_output:
  description: |
   ibus-table-createdb in ibus-table creates sqlite databases with
   non-deterministic order.
  url: https://bugs.debian.org/797521
random_order_in_antlr_output:
  description: |
    The ANTLR parser generator can have reordered source lines.
    Fixed in antlr3/3.5.2-3.
timestamps_in_tex_documents:
  description: |
    The TeX \today macro embeds the build date in the files generated
    from it (DVI, PS, PDF, etc.). This should probably be changed to
    honour SOURCE_DATE_EPOCH from the environment.
    .
    This can sometimes be explicit in the \maketitle command.
  deterministic: True
timestamps_added_by_blast2:
  description: |
    formatdb from blast2 adds a timestamp.
  deterministic: True
randomness_in_r_rdb_rds_databases:
  status:
    done
  description: |
    R creates .rdb files and .rds with some randomness. They are a serialisation of some
    sorts, related to lazy loading of modules?
    Randomness seems to come from using absolute paths in .rd[bs] files.
    .
    Is not related to https://bugs.debian.org/774031 / r_base_appends_built_header_to_description_files
    .
    We have a pending patch to fix most of these (463/478) packages at the time
    of writing) upstream in R:
    .
    https://stat.ethz.ch/pipermail/r-devel/2017-April/074138.html
    .
    When this is accepted into R upstream, commit 28d4af25 may be
    (un-)reverted to remove these packages. In the meantime, please do not
    remove this issue, nor mark it as deterministic, nor untag these packages.
    .
    The remaining ~15 packages are not completely fixed by this patch, so this
    issue should remain, even when our upstream patch is accepted. These
    packages will need to be investigated and fixed individually, see our blog
    post on how to do that:
    .
    https://reproducible-builds.org/news/2017/05/03/reproduciing-r-packages/
captures_build_path_in_r_rdb_rds_databases:
  description: |
    The build path is sometimes captured in R .rds and .rdb files.
python-ply_compiled_parse_tables:
  description: |
    python-ply generates parse tables (eg. parsetab.py) that are
    non-deterministic.
    .
    This is a deeper issue than simply writing them out deterministically
    ("write_table" in yacc.py) but rather further up the chain within PLY.
    .
  url: https://github.com/dabeaz/ply/issues/79
python-ply_lextokens:
  description: |
    python-ply generates _lextokens variables with nondeterministic ordering.
  url: https://bugs.debian.org/890620
ftbfs_due_to_disorderfs:
  description: |
    collect FTBFS related to disorderfs, eg. read errors, etc.
timestamps_in_manpages_generated_by_docbook_utils:
  description: |
    docbook2man from docbook-utils adds the build date into generated manpages, which also contain locale variations.
  url: https://bugs.debian.org/800797
  deterministic: True
python_shebang_and_dependency_nondeterministically_3_or_3_point_5:
  description: |
    The initial line of python programs is #!/usr/bin/python3.5 in build1 and #!/usr/bin/python3 in build2.
    This is caused by us building multiple Python versions into separate
    directories under {build_dir} but then installing them to the *same*
    {destdir}.
    .
    If any of these builds complete in under 1 second, distutils may decide to
    skip copying files to {destdir} as it incorrectly believes them to be
    up-to-date. This will result in a package arbitrarily containing scripts
    with different version shebangs and, by extension, binary dependencies.
  url: https://bugs.debian.org/804339
timestamps_in_directories:
  description: |
    Timestamps of one or more directories change from build1 to build2. This is probably a debhelper issue
    and it's different from varying_mtimes_in_data_tar_gz_or_control_tar_gz which is mainly for packages that
    do not try to build reproducibly yet.
  url: https://bugs.debian.org/802005
  deterministic: True
random_order_in_static_libraries:
  description: |
    order of members in a static library change between build1 and build2
random_order_in_md5sums:
  description: |
    order of files in md5sums (in control.tar.gz) differ from build1 to build2. This only happens in
    packages not using dh_md5sums and it's easily fixed by sorting the output of "find" before
    piping it to md5sum. Example:
    .
    cd debian/tmp && \
        find * -type f ! -regex "^DEBIAN/.*" -print0 |\
        LC_ALL=C sort -z | xargs -0r md5sum > DEBIAN/md5sums
ftbfs_uninvestigated_test_failures:
  description: |
    Packages that can compile their binaries without problems but then fail
    one or more tests for unidentified reasons.
timestamps_in_pdf_content:
  description: |
    The timestamp is not in the PDF metadata, but embedded in the actual content (text).
    Note: Use timestamps_in_tex_documents instead, which is more specific, if the PDF was created
    by a TeX/LaTeX document using \today macro.
  deterministic: True
different_encoding_in_html_by_docbook_xsl:
  description: |
    Docbook XSL can vary the encoding it uses depending on locale.
timestamps_in_ppu_generated_by_fpc:
  description: |
    The freepascal compiler (fpc) embeds timestamps into unit files (ppu).
    This is not a problem when the source file is not modified at build time, but if eg. the source file is patched by a debian patch from quilt, the timestamp of this file is set to build time and propagated in the binary.
  url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInPPUGeneratedByFPC
  deterministic: True
ftbfs_old_compat_debheper_compat_level:
  description: |
    debhelper 9.20151116 removed support for the compat levels 1, 2.
    So those packages now fail to build.
  url: https://lists.debian.org/debian-devel/2015/09/msg00257.html
  deterministic: True
timestamps_in_documentation_generated_with_libwibble:
  description: |
    libwibble can generate manpages for applications using it.
    While doing so, it embeds the current date into the manpage.
  url: https://sources.debian.net/src/libwibble/latest/wibble/commandline/doc.cpp/#L320
  deterministic: True
copyright_year_in_documentation_generated_by_sphinx:
  description: |
    Sphinx is embedding the current year into copyright statements in generated documentation.
  See also: https://bugs.debian.org/820895
  url: https://sources.debian.net/src/sphinx/latest/sphinx/themes/basic/layout.html/#L191
timestamps_in_documentation_generated_by_glib_genpod:
  description: |
    Glib::GenPod in libglib-perl generates POD documentation that embeds
    the current year in a copyright notice.
    .
    https://sources.debian.net/src/libglib-perl/latest/lib/Glib/GenPod.pm/#L43
    .
    Fixed in libglib-perl 3:1.321-1.
  deterministic: True
random_hashes_in_cython_output:
  description: |
    Cython generates .c/.cpp code from a Python-like syntax. Some of it is has
    random numbers in it.
random_order_in_cython_output:
  description: |
    Cython generates .c code from a Python-like syntax. Some of it is in
    non-deterministic order.
  url: https://bugs.debian.org/806493
tempdir_in_cython_cythonize:
  description: |
    Cython called via cythonize in, e.g. pyproject.toml, creates ELF debug entries with a nondetermistic temporary directory such as "/tmp/.tmp-propcache-pep517-11hza083/src/src/propcache/_helpers_c.c:9725"
timestamps_in_python_code_generated_by_pyside:
  description: |
    The resource compiler from pyside-tools embeds a creation timestamp into the generated Python source.
  url: https://bugs.debian.org/806527
  deterministic: True
timestamps_in_sym_l_files_generated_by_malaga:
  description:
    Malaga, a system for automatic language analysis, includes the current time
    in its output header files.
    .
    https://sources.debian.net/src/malaga/latest/malaga_files.h/#L34
    https://sources.debian.net/src/malaga/latest/malaga_files.c/#L79
    https://sources.debian.net/src/malaga/latest/malaga_files.c/#L88
  deterministic: True
timestamps_in_edj_files_generated_by_edje_cc:
  description:
    /usr/bin/edje_cc from libedje-bin writes timestamps.
  deterministic: True
timestamps_in_copyright_added_by_perl_dist_zilla:
  description:
    distzilla adds "Copyright $current_year" to .pm files
  deterministic: True
random_contents_in_dat_files_generated_by_chasen-dictutils_makemat:
  description:
    /usr/lib/x86_64-linux-gnu/chasen/makemat from chasen-dictutils generates
    .dat files with some random/non-deterministic contents.
    Solved by patch in https://bugs.debian.org/881231
timestamps_in_documentation_generated_by_pandoc:
  description:
    Pandoc writes a timestamp in the HTML and manpages it generates.
  deterministic: True
nondeterministic_output_generated_by_moarvm:
  description:
    moarvm creates .moarvm files that have non-deterministic identifiers,
    possibly to ensure uniqueness. unknown source.
    The upcoming 2019.04 moarvm release should fix all these issues.
nondeterministic_output_in_warnings_generated_by_breathe:
  description:
    If you use "doxygenfunction" sphinx directive provided by breathe and the
    function is ambiguous, then the warning message injected into the docs can
    be non-deterministic.
  url: https://bugs.debian.org/809186
qt_translate_noop_nondeterministic_ordering:
  description:
    QT_TRANSLATE_NOOP macro creates a sqlite database with entry IDs (?) that
    are nondeterministic
build_date_in_manpage_generated_by_spf13_cobra:
  description: |
    'Auto generated by spf13/cobra'
    Fix merged upstream https://github.com/spf13/cobra/pull/735
timestamps_in_manpages_added_by_golang_cobra:
  description:
    Go's "cobra" doc generator adds timezone-varying timestamp of (what is
    probably) the current time.
    .
    Homepage is https://godoc.org/github.com/spf13/cobra
timestamps_in_manpages_added_by_golang_go_flags:
  description: |
    golang-go-flags adds the current time to manpages.
    Fix merged upstream https://github.com/jessevdk/go-flags/pull/285
  url: http://sources.debian.net/src/golang-go-flags/1.1-1/man.go/#L177
lxqt_translate_desktop_binary_file_matched_under_certain_locales:
  description:
    The lxqt_translate_desktop QT/LXDE CMake utility methods calls grep which,
    under certain locales, generates a "Binary file matched" instead of the
    actual match.
    .
    Seems to be code-copied everywhere, alas.
    .
    The affected packages have been already fixed upstream, no need to send
    more patches for this issue :)
timestamps_in_manpages_generated_by_autogen:
  description: |
    autogen adds a timestamp in manpages it generates.
  deterministic: True
captures_shell_variable_in_autofoo_script:
  description: |
    Something looking like autotools is capturing SHELL for use at
    runtime, which should probably be fixed to /bin/sh anyway.
    .
    Autotools also capturing the build path.
varying_ordering_in_data_tar_gz_or_control_tar_gz:
  description: |
    Previously part of not_using_dh_builddeb
timestamps_generated_by_xbean_spring:
  description: |
    xbean-spring adds timestamps to files it adds in META-INF.
  deterministic: True
timestamps_generated_by_mangosdk_spiprocessor:
  description: |
    org.mangosdk.spi.processor.SpiProcessor adds timestamps to files it creates
    in META-INF.
  deterministic: True
copyright_year_in_comments_generated_by_ckbuilder:
  description: |
    CKBuilder.utils.copyright adds current year in the copyright header of
    generated files.
  deterministic: True
timestamps_in_htm_by_gap:
  description: |
    The etc/convert.pl script from gap embeds timestamps with the current time
    and using the local language in the HTM files it produces.
  deterministic: True
unsorted_file_glob_by_cmake:
  description: |
    File lists are generated in a CMakeLists.txt file with file(GLOB ...), which varies
    with the readdir() order. This file list is passed to add_executable / add_library or
    otherwise used for generating an output.
    A solution is to sort the lists: list(SORT SRC_FILES)
  url: https://bugs.debian.org/824263
scons_doesnt_pass_environment_to_build_tools:
  description: |
    The build system SCons doesn't pass environment variables to the build tools (compilers etc.) by default.
    See scons(1):
    "scons does not automatically propagate the external environment used to execute scons to the commands used to build target files. This is so that builds will be guaranteed repeatable regardless of the environment variables set at the time scons is invoked"
    This prevents for example that SOURCE_DATE_EPOCH can be read by build tools.
    .
    This can be worked around by explicitly importing
    SOURCE_DATE_EPOCH in the SConstruct or similar file,
    such as the patch in https://bugs.debian.org/1010466
ruby_mkmf_makefile_unsorted_objects:
  description: |
    Ruby projects which also include C sources and use create_makefile from mkmf.rb (typically in ext/.../extconf.rb) will be unreproducible, because the list of object files in the generated Makefile is unsorted.
    .
    Many of those packages are likely affected:
    https://codesearch.debian.net/perpackage-results/path%3Aextconf.rb%20create_makefile/2/page_0
    .
    ruby: https://sources.debian.net/src/ruby2.3/latest/lib/mkmf.rb/#L2180
    jruby: https://sources.debian.net/src/jruby/latest/lib/ruby/shared/mkmf.rb/#L1488
  url: https://bugs.debian.org/825569
timestamps_in_pdf_generated_by_imagemagick:
  description: |
    When converting images to PDF files, imagemagick embeds the current time/date into metadata (CreationDate / ModDate).
  url: https://bugs.debian.org/819914
  deterministic: True
random_order_in_native_libs_by_setuptools:
  description: |
    python-setuptools generates native_libs.txt with random order.
  url: https://bugs.debian.org/825857
timestamp_in_info_file_created_by_makeinfo:
  description: |
    the build date is included in the info file generated by makeinfo when the source texi file includes @today{}.
  url: https://bugs.debian.org/826158
  deterministic: True
date_added_by_ui_auto:
  description: |
    ui-auto m4 script inserts `date --rfc-822`. Reverse build-depends will
    probably need autoreconfing and extra Build-Depends, alas. Patch in itself
    shouldn't be too hard (ui-auto:src/m4/ui-auto.m4)
  deterministic: True
nondeterminism_added_by_pyqt5_pyrcc5:
  description: |
    Unknown non-determinism added by this tool that turns files into Python.
    (PNG metadata? Ordering?)
    .
    Untested patch here: https://gist.github.com/lamby/d86fc228ae00733f1705b4ef80a5d7bb/raw
  url: https://bugs.debian.org/1024114
cryptographic_signature:
  description: |
    The package embeds cryptographic signatures into build artefacts with keys generated during build.
  deterministic: True
r_base_appends_built_header_to_description_files:
  description: |
    r-base appends "Built: blah" header to DESCRIPTION files.
    https://sources.debian.net/src/r-base/latest/share/make/basepkg.mk/#L101
  deterministic: True
  url: https://bugs.debian.org/774031
timestamps_in_documentation_generated_by_mkdocs:
  description: |
    includes a "Build Date UTC" footer
  url: https://bugs.debian.org/828145
  deterministic: True
randomness_in_documentation_generated_by_mkdocs:
  description: |
    Especially Python function labels (eg. 'property' and 'writable') being
    generated in a nondeterminstic order.
  url: https://bugs.debian.org/1037216
  deterministic: False
random_order_of_pdf_ids_generated_by_latex:
  description: |
    latex uses IDs such as dcf70a72907fd3b4786a8ec9b9155636 to identify
    elements. Whilst these are deterministic, the ordering they are outputted
    are not deterministic.
    .
    This can be disabled by inserting \pdftrailerid{} into the PDF document,
    but this should (by default) probably be set to SOURCE_DATE_EPOCH if set.
    .
    (Might be caused by PSOutputDev::setupFonts in embedded poppler PDFDoc.cc)
    .
    (Or http://sources.debian.net/src/texlive-bin/latest/texk/web2c/pdftexdir/pdftex.web/#L20122-L20129)
    .
    (This might be tagged the same as random_id_in_pdf_generated_by_dblatex)
  url: http://tug.org/pipermail/tex-live/2017-June/040398.html
timestamps_in_output_generated_by_txt2tags:
  description: |
    txt2tags uses the current localtime in mtime macros and date macros
  url: https://bugs.debian.org/829325
  deterministic: True
random_order_in_documentation_generated_by_naturaldocs:
  description: |
    non-deterministic ordering of stubs, etc.
buildpath_in_binaries_generated_by_d_compiler_ldc:
  description: |
    Binaries generated by the LLVM D compiler can encode the buildpath, possibly due
    to assertions.
buildpath_in_binaries_generated_by_d_compiler_gdc:
  description: |
    Binaries generated by the GNU D compiler can encode the buildpath, possibly due
    to assertions.
randomness_in_binaries_generated_by_d_compiler_gdc:
  description: |
    Binaries generated by the GNU D compiler seem to have some kind of random
    content. Appears to differ across architectures.
randomness_in_binaries_generated_by_sbcl:
  description: |
    Binaries generated by the common Lisp compiler and development system
    include the current locale ("fixed" with LC_ALL=C), but there are also misc
    non-deterministic changes.
random_xspp_identifier_by_extutils_xspp:
  description: |
    ExtUtils::XSPP generates random identifiers that are included in generated C code.
    https://sources.debian.net/src/libextutils-xspp-perl/latest/lib/ExtUtils/XSpp/Lexer.pm/#L141
    .
    Possible solution is seeding the rng with srand($SOURCE_DATE_EPOCH) in ExtUtils/XSpp/Cmd.pm.
ftbfs_with_-fdebug-prefix-map_error:
  description: |
    The package fails to build due to our use of -fdebug-path-map in the default
    buildflag set
  deterministic: True
unknown_ada_issue:
  description: |
   Previously part of build_id_variation_requiring_further_investigation
   .
   Symptoms are similar to random_order_in_static_libraries.
   Not to be confused with timestamps_in_ada_library_information_files,
   buildpath_in_binaries_generated_by_ada_compiler,
   cflags_recorded_in_ada_ali_files.
user_in_documentation_generated_by_gsdoc:
  description:
    GNUstep's gsdoc adds "generated by $USER" to some API documentation.
captures_build_path:
  description: |
    Captures build path, e.g., /build/1st/foo-42.0 v. /build/foo-42.0/2nd
    .
    Until early 2024 we varied the build path when testing packages from unstable
    and experimental, which we have stopped doing now as the build path is recorded
    as part of the environment and thus can be used when rebuilding.
    .
    This issue is kept here for the time being.
    .
    This issue is only for miscellaneous issues which need individual fixes,
    please create new issues for specific issues, e.g. gcc_captures_build_path.
    .
    Here follows some general tips for packages using the standard GNU toolchain:
    .
    If using autoconf, make sure you call ./configure via a relative and not absolute path.
    .
    If your issue is related to using the `__FILE__` macro, or the recording of
    --debug-prefix-map flags in non-GCC non-debugging output, this is what is
    fixed by our patch mentioned above; you should not need to fix it
    specifically in your package.
    .
    For more background information see:
    .
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160822/006788.html
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160905/006984.html
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160912/007076.html
  deterministic: True
captures_build_path_in_beam_cma_cmt_files:
  description: |
    Erlang beam files contain the beam path, in a field apparently named "source".
  deterministic: True
captures_home_dir:
  description:
    Captures home directory, e.g., first-build v. second-build.
  deterministic: True
captures_execution_time:
  description:
    Captures execution time, which may vary between builds.
fortran_captures_build_path:
  description: |
    Contains paths to .f90 files or similar.
golang_compiler_captures_build_path_in_binary:
  description: |
    The golang compiler embeds the source/build paths into binaries.
  url: https://github.com/golang/go/issues/16860
  deterministic: False  # XXX FIXME this is True, but let's keep it False until it's upstreamed
hevea_captures_build_path:
  description: |
    hevea capture the build path in 2 places inside the generated HTML file: (only if full-path used instead of relative path as argument)
    1. inside HTML comment "HEVEA command line is:"
    2. if \title is missing in received .tex file, the HTML title tag will contain the path to generated file without file extension.
  deterministic: True
lessc_captures_build_path:
  description: |
    lessc captures the build path in source maps. To fix, give
    .
    1. Pass --source-map-basepath=$SOURCE_ROOT_DIR, e.g.
       https://anonscm.debian.org/cgit/python-modules/packages/jupyter-notebook.git/commit/?id=39bdadbf346e8f77aed5d40dc0de9c30d0b7498b
    2. Make the output file path relative, until https://github.com/less/less.js/pull/3002 is fixed and accepted, e.g.
       https://anonscm.debian.org/cgit/python-modules/packages/jupyter-notebook.git/commit/?id=529a67483a53ac55be58c46d9864e86d733cd113
    .
    Eventually we can fix (2) and make (1) unnecessary by reading SOURCE_PREFIX_MAP
  deterministic: True
lessc_nondeterministic_keys:
  description: |
    Writes out Javascript .map files that are not sorted alphabetically by key/mapping.
    .
    I think this is actually done in node-source-map, but it appears to be sorted.
timestamp_added_by_java_util_properties:
  description:
    java.util.Properties adds a timestamp
    .
      -#Sun Jul 24 11:39:42 GMT-12:00 2016
      +#Sun Aug 27 20:06:07 GMT+14:00 2017
    .
    https://stackoverflow.com/questions/6184335/properties-store-suppress-timestamp-comment
    http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/6-b14/java/util/Properties.java#Properties.store0%28java.io.BufferedWriter,java.lang.String,boolean%29
  deterministic: True
  url: https://bugs.debian.org/914278
perl_extutils_xspp_captures_build_path:
  description:
    ExtUtils::XSpp captures the build path in the headers.
    .
    https://sources.debian.net/src/libmodule-build-withxspp-perl/latest/lib/Module/Build/WithXSpp.pm/#L230
  url: https://bugs.debian.org/835447
  deterministic: True
href_links_mangled_by_node_marked:
  description:
    marked html-encodes email addresses in an unreproducible way.
    .
    https://sources.debian.net/src/node-marked/latest/lib/marked.js/#L740
uname_output_in_python_debugging_symbols_caused_by_sysconfig_getplatform:
  description: |
    encoded in tempfile. Affects building on i386 as it does not distinguish
    between userland vs kernel.
    .
    https://sources.debian.net/src/python2.7/latest/Lib/sysconfig.py/#L572-L584
    https://sources.debian.net/src/python3.5/latest/Lib/sysconfig.py/#L646-L658
  url: https://bugs.debian.org/835805
  deterministic: True
cython_captures_build_path:
  description: |
    eg static const char __pyx_k_home_lamby_temp_cdt_20160827233[] = "/home/lamby/temp/cdt.20160827233114.crIlYLxW7D.repro.python-brainstorm/build-b/python-brainstorm-0.5/brainstorm/handlers/_cpuop.pyx";
  deterministic: True
  url: https://bugs.debian.org/849328
timestamp_in_enc_files_added_by_texlive_fontinst:
  description: |
   -%    date = "generated 2017/09/15",
   +%    date = "generated 2016/08/14",
   .
   https://sources.debian.net/src/texlive-extra/latest/texmf-dist/tex/fontinst/base/finstmsc.sty/#L899
  deterministic: True
random_id_in_pdf_generated_by_dblatex:
  description: |
    eg.
    /ID [<1ebdbec86dcab3e39cf225470b799ae8> <1ebdbec86dcab3e39cf225470b799ae8>]
    .
    Not caused by build path nor by the minute used to build at least.
    Intermediate "--tempdir=docbuild" has no differences.
    .
    ID is varying because texlive generates it based on the build path, see also
    pdf_id_varying_due_to_build_path issue.
    .
    (This might be tagged the same as random_order_of_pdf_ids_generated_by_latex)
    .
    (Or http://sources.debian.net/src/texlive-bin/latest/texk/web2c/pdftexdir/pdftex.web/#L20122-L20129)
  url: http://tug.org/pipermail/tex-live/2017-June/040398.html
random_order_in_sisu_javax_inject_named:
  description: |
    libsisu-maven-plugin-java generates META-INF/sisu/javax.inject.Named files in
    an apparently random order.
captures_users_gecos:
  description:
    Captures user's GECOS, e.g., second room.
    .
    Sub-issue<imagine a colon> texi2html_captures_users_gecos
texi2html_captures_users_gecos:
  description:
    Difference in the "This documented was generated on/by" line, documented in the notes of the 'texi2html' package.
    Sub-issue of captures_users_gecos
timestamps_in_org_mode_html_output:
  description: |
    emacs' org-mode can convert .org to .html on the command line, eg
    .
    $ emacs README.org --batch -f org-html-export-to-html --kill
    .
    This adds some timestamps, including
    .
      <!-- 2016-09-24 sam 14:54 -->
      <p class="date">Created: 2016-09-24 sam 14:54</p>
    .
    Looks like can be be overridden per-document but the patch from 824050 may
    be able to be adapted for fixing org-mode mode generally.
records_build_flags:
  description: |
    Records $CFLAGS, which vary intentionally due to the «-fdebug-prefix-map=${BUILDPATH}=.»,
    «-ffile-prefix-map=${BUILDPATH}=.» or «-fmacro-prefix-map=${BUILDPATH}=.» flags.
    .
    We have a patch pending to GCC to fix this issue centrally:
    .
    https://gcc.gnu.org/ml/gcc-patches/2016-11/msg00182.html
    .
    Though the patch is currently unlikely to be merged. If/when this
    is accepted, this issue should be fixed for all packages and you
    should not need to fix it specifically in your package.
    .
    There is also a work-in-progress patch to dpkg that could address this issue:
    .
    https://bugs.debian.org/985553
    .
    For more background information see:
    .
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160822/006788.html
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160905/006984.html
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160912/007076.html
  deterministic: False  # XXX FIXME this is also true
records_build_flags_from_ecbuild:
  description: |
    ecbuild generates a PACKAGE_ecbuild_config.h that contains the
    build flags.
    https://sources.debian.org/src/ecbuild/3.7.1-1/cmake/ecbuild_config.h.in/#L44-L48
    .
    Parent issue: records_build_flags
clilibs_line_order:
  description: |
    [armhf/i386 only, so may be disorderfs related]
    Line order in 'clilibs' differs, in cli/mono packages.
  url: https://bugs.debian.org/851809
pdf_id_varying_due_to_build_path:
  description: |
    The PDF /ID is generated based on timestamps (which are now deterministic) and the path of the source file.
    texlive needs to be fixed to strip the build path prefix while generating the ID.
build_id_differences_only:
  description: |
    The Build ID differs, but there are no other differences.
    .
    Specifically, NT_GNU_BUILD_ID, .gnu_debuglink, and
    /usr/lib/debug/build-id/* filenames differ, but there are no other
    differences.
    .
    [On 'sope' seen also a difference in a .GCC.command.line section; compare 'records_build_flags'.]
    .
    If there _are_ other differences (or if diffoscope output is truncated),
    don't tag with this issue, but look for the root problem, as explained
    under build_id_variation_requiring_further_investigation.
    .
    When this occurs on unstable but not on testing, it's likely a form
    of captures_build_path. If it uses the cmake buildsystem, very
    likely to be cmake_rpath_contains_build_path.
captures_build_path_via_assert:
  description: |
    Absolute paths to source file names are embedded through assert(), which
    embeds the value of the __FILE__ macro in the .data section, or via
    filenames in debug symbols, which shows in the .text and .debug_str sections.
    .
    We have a pending patch to GCC to fix this in one central place.
    .
    https://gcc.gnu.org/ml/gcc-patches/2016-11/msg00182.html
    .
    If/when this is accepted, this issue should be fixed for all packages and
    you should not need to fix it specifically in your package.
    .
    For more background information see:
    .
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160822/006788.html
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160905/006984.html
     • https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160912/007076.html
captures_build_arch:
  description: |
    Captures the build arch (`uname -m`, typically i686 v. x86_64).
captures_build_arch_via_ecbuild:
  description: |
    ecbuild generates a PACKAGE_ecbuild_config.h that embeds the
    running kernel architecture.
    .
    Parent issue: captures_build_arch
graphviz_nondeterministic_output:
  description: |
    graphviz appears to use a non-deterministic algorithm to optimally lay out
    notes optimally. This can appear in class hierarchy documentation, etc. Can
    presumably affect images of all complexity but, obviously, more likely to
    affect images with lots of nodes.
    .
    see https://twitter.com/Graphviz/status/1039632469782396929
bin_sh_is_bash:
  description: |
    Various issues that are caused from whether /bin/sh is dash or bash.
unrelated_ftbfs:
  description: |
    FTBFS on tests.r-b.o and on buildd.d.o, and for the same reason.
  deterministic: True
sphinx_htmlhelp_readdir_sensitive:
  description: |
    [armhf,i386] The [FILES] section of sphinx htmlhelp (*.hhp) files appears in readdir() order:
      sphinx/builders/htmlhelp.py:223:            for root, dirs, files in os.walk(outdir):
    .
    The current test setup shows this on armhf/i386 only since it doesn't use disorderfs on amd64.
  url: https://bugs.debian.org/884010
txt2man_dash_p:
  description: |
    «txt2man -p» parses the build path for the package name and version.
    .
    Fix: replace the -p by explicit -t TITLE -s SECTION -v "foo Reference Manual" -r "$$(dpkg-parsechangelog -SSource)-$$(dpkg-parsechangelog -SVersion)"
  deterministic: True
randomness_in_browserify_output:
  description: |
    Node.js compiler. Generates, for example, bundle.js files with sourceMappingURL=
    randomness
randomness_in_browserify_lite_output:
  description: |
    browserify-lite "bundles client-side JavaScript using Node.js-style module
    syntax", mostly concatenating it. The output is non-deterministic.
  url: https://github.com/andrewrk/browserify-lite/pull/14
nondeterministic_output_from_uglifyjs:
  description: |
    uglifyjs does not create deterministic output in, for example, JS dicts.
timestamp_in_tables_generated_by_casacore_measuresdata:
  description: |
    src:casacore's measuresdata script generates .dat files that embed the
    build date
translations_missing_due_to_intltool_merge:
  description: |
    A file contains a list of «Name[xx] = "String"» lines, where «xx» is a language code;
    some or all of the lines are present in one build only.
    .
    Possibly a bug (race condition between multiple invocations?) in intltool-merge. Maybe fixed by https://bugs.launchpad.net/intltool/+bug/1687644 and https://bugs.debian.org/950444
    .
    Also occurs in .directory files?
  deterministic: False
help2man_puts_traceback_in_generated_man_page:
  description: |
    A man page generated by help2man consists of a traceback and nothing else; see #851336 for an example.
    .
    That's not a reproducibility bug, but we catch it when the traceback contains abspaths that embed $SOURCE_ROOT_DIR.
  deterministic: False
captures_kernel_version_via_CMAKE_SYSTEM:
  description: |
    Uses CMAKE_SYSTEM, which embeds `uname -sr` output; the -r (version) varies.
    .
    Instead, use CMAKE_SYSTEM_NAME (`uname -s`), which shouldn't vary.
    .
    May also be triggered by use of CMAKE_HOST_SYSTEM,
    CMAKE_HOST_SYSTEM_VERSION or CMAKE_SYSTEM_VERSION.
    .
    Parent issue: captures_kernel_version
  deterministic: False
captures_kernel_version_via_ecbuild:
  description: |
    ecbuild generates a PACKAGE_ecbuild_config.h that embeds the
    running kernel version.
    https://sources.debian.org/src/ecbuild/3.7.1-1/cmake/ecbuild_config.h.in/#L32
    .
    Parent issue: captures_kernel_version
python_versioneer_uses_parentdir:
  description: |
    Embedded copies of versioneer use the build path to calculate a version.
    eg. https://bugs.debian.org/852482
absolute_build_paths_in_dot_packlist_file_generated_by_perl_extutils_packlist:
  description: |
    ExtUtils::Packlist adds absolute build directories:
    33 =item __find_relocations
    34
    35 Works out what absolute paths in the configuration have been located at run
    36 time relative to $^X, and generates a regexp that matches them
    .
    Are they of any use in a Debian context? If not, the files could just be
    removed by some Perl helper, etc.
timestamp_and_build_path_captured_by_python_cheetah:
  description: |
    │ │ │ │ +__CHEETAH_genTime__ = 1520634040.436206
    │ │ │ │ +__CHEETAH_genTimestamp__ = 'Sat Mar 10 12:20:40 2018'
    │ │ │ │ +__CHEETAH_src__ = '/build/xmds2-2.2.3+dfsg/2nd/xpdeint/Features/AsciiFormat.tmpl'
    │ │ │ │ +__CHEETAH_srcLastModified__ = 'Mon Jul 23 13:42:26 2012'
  deterministic: True
formatdb_from_ncbi_blastplus_captures_build_time:
  description: |
    formatdb calls such as [1] capture the build time.
    The build time is captured in [2] and written out in [3].
    [1] https://sources.debian.net/src/metastudent-data/latest/Makefile.am/#L24
    [2] http://sources.debian.net/src/ncbi-blast%2B/latest/c%2B%2B/src/objtools/blast/seqdb_writer/writedb_impl.cpp/#L78-L87
    [3] http://sources.debian.net/src/ncbi-blast%2B/latest/c%2B%2B/src/objtools/blast/seqdb_writer/writedb_files.cpp/#L267
  deterministic: True
randomness_in_t3g_files_generated_tslmendian:
  description: |
    Looks like arbitrary memory?
randomness_in_swf_files_generated_by_as3compile:
  status:
    done
  description: |
    as3compile (src:sfwtools) generates non-deterministic .swf files.
nondeterminism_in_java_classes_generated_by_jxc:
  description: |
    The "JAXB schema compiler" jxc (src: openjdk-{6,7} etc.) generates .class
    files from .xml files. There is some non-determinism in the generated code.
timestamps_in_episode_files_generated_by_jxc:
  description: |
    The "JAXB schema compiler" jxc (src: openjdk-{6,7} etc.) generates .episode
    files with the current timestamp.
timestamp_in_fonts_generated_by_opentype:
  description: |
    opentype generates .ttf files with a timestamp of the current time.
randomness_in_binaries_generated_by_ruby_mkmf:
  description: |
    I think it's a timestamp that is used as part of the makefile (etc.)
    generation.
    .
    /usr/bin/ruby2.3 -r ./siteconf20180314-61474-whhjsn.rb extconf.rb
filesystem_ordering_in_pak_files_generated_by_simutrans_makeobj:
  description: |
    Loops over input directory in filesystem ordering.
timestamp_in_jboss_messagebundle_generated_code:
  description: |
    JBoss @MessageBundle (translation) generated classes contain a generation date and time. This
    timestamp is only retained in the generated code, so doesn't appear in the binary unless you
    generate documentation from it.
    https://sources.debian.net/src/jboss-logging-tools/latest/processor/src/main/java/org/jboss/logging/processor/generator/model/ClassModel.java/#L146
  deterministic: True
portable_executable_strong_name_varies:
  description: |
    Some sort of signing system. See the sn tool.
timestamps_in_manpages_created_by_libwibble:
  description: |
    libwibble ("Library of various useful C++ code") can generate manpages but
    they use the current time.
    .
    http://sources.debian.net/src/libwibble/latest/wibble/commandline/doc.cpp/#L232
  url: https://bugs.debian.org/861672
timestamps_in_cbd_files_generated_by_canna_mkbindic:
  description: |
    timestamps added by mkbindic from canna package
  url: https://bugs.debian.org/861955
gcc_captures_build_path:
  description: |
    Captures build path, e.g., /build/1st/foo-42.0 v. /build/foo-42.0/2nd
    .
    Until early 2024 we varied the build path when testing packages from unstable
    and experimental, which we have stopped doing now as the build path is recorded
    as part of the environment and thus can be used when rebuilding.
    .
    This issue is kept here for the time being.
    .
    dpkg-buildflags version 1.20.6+ sets -ffile-prefix-map by default
    (and -fdebug-prefix-map in older versions) which fixes this issue
    in many cases, but not all (see: records_build_flags).
    .
    There are patches submitted upstream to address this specific issue, but they 
    are unlikely to be merged at this point:
    .
    https://gcc.gnu.org/ml/gcc-patches/2017-04/msg00513.html
    .
    When this is accepted into GCC upstream, we could remove this note.
    In the meantime, please do not remove this issue, nor mark it as deterministic,
    nor untag these packages.
  deterministic: False
apxs_captures_build_path:
  description: |
    apxs or apxs2 tools used to build apache modules do not use
    default *FLAGS. The compiled objects may embed the build path as a
    result.
    .
    apxs can pass arguments to the compiler using
    "-Wc,-ffile-prefix-map=$(CURDIR)=."
ocaml_captures_build_path:
  description: |
    Captures build path, e.g., /build/1st/foo-42.0 v. /build/foo-42.0/2nd
  deterministic: False
ocaml_dune_captures_build_path:
  description: |
    Captures build path, e.g., /build/1st/foo-42.0/_build v. /build/foo-42.0/2nd/_build
  deterministic: False
jellyfish_creates_nondeterministic_json:
  description: |
    /usr/bin/jellyfish can generate non-deterministic JSON.
  deterministic: False
  url: https://bugs.debian.org/863015
timestamps_in_javascript_generated_by_node_grunt_banner:
  description: |
    Grunt's support for adding a banner (in src:node-grunt) has a templating
    system that uses the current time, not SOURCE_DATE_EPOCH.
  url: https://bugs.debian.org/867753
build_path_captured_by_valac:
  description: |
    Presumably to generate a unique name, valac generates C preprocessor defines such as
    .
      ___HOME_FAB_CD2_CAIRO_DOCK_PLUG_INS_DBUS_INTERFACES_VALA_SRC_CDAPPLET_H__
    .
    ... which contain the build path.
timestamps_in_source_generated_by_rcc:
  description: |
    resource files generated by Qt's resource compiler (rcc) depend on mtimes
    of the input files, which may have been generated at build time.
    .
    There is an upstream bug https://bugreports.qt.io/browse/QTBUG-62511 and a
    corresponding merged pull request https://codereview.qt-project.org/202999.
    .
    A temporary solution is to add '--format-version 1' to the rcc command line.
  deterministic: True
build_path_captured_by_python_numpy_misc_util:
  description: |
    numpy/distutils/misc_util.py in src:python-numpy writes the full source
    filename to generated files.
  url: https://bugs.debian.org/872459
  deterministic: True
nondeterministic_output_generated_by_gcab:
  description: |
    gcab generates .cab files that vary due to encoding timezone
  url: https://bugs.debian.org/872460
  deterministic: True
captures_build_dir_in_qmake_prl_files:
  description: |
    QMAKE_PRL_BUILD_DIR contains the absolute build path.
  deterministic: True
build_path_captured_in_assembly_objects:
  description: |
    This is issue has been fixed for GCC 13 on 2022-11-02.
    .
    Before GNU as didn't support BUILD_PATH_PREFIX_MAP, so objects compiled from
    assembly sources captured the build path.
    .
    Before GNU "as" only supported --debug-prefix-map=BUILDPATH=. which can
    sometimes be passed via ASMFLAGS, ASFLAGS, or similar variables.
  url: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93371
timestamps_in_ifo_files_generated_by_python_stardicter:
  description: |
    python{,3}-stardicter generates .ifo files with the current date.
    .
    Upstreamed here: https://github.com/nijel/stardicter/pull/2
  url: https://bugs.debian.org/881089
randomness_in_files_generated_by_pinyin_gen_binary_files:
  description: |
    /usr/bin/gen_binary_files from libpinyin-utils generates non-deterministic
    output.
build_path_in_files_generated_by_qdbusxml2cpp:
  description: |
    eg. The command line was qdbusxml2cpp -m -i pimcommon/metatype.h -p imapresourcesettings <buildpath>
timestamps_in_rcc_files_generated_by_rcc:
  description: |
    /usr/lib/qt5/bin/rcc from qtbase5-dev-tools (src qtbase-opensource-src)
    embeds a last modified timestamp in the generated .rcc file.
    .
    http://sources.debian.net/src/qtbase-opensource-src/latest/src/tools/rcc/rcc.cpp/#L207-L212
nondeterminism_in_documentation_generated_by_pydoctor:
  description: |
    eg. non-deterministic HTML id attributes.
  url: https://bugs.debian.org/884254
nondeterminism_in_files_generated_by_rime_deployer:
  description: |
    Looks like struct mem?
gfortran_mod_captures_build_path:
  description: |
    gfortran generates .mod and .smod files that can capture the build path.
    A patch for gfortran : https://bugs.debian.org/889133
    Also, a small workaround script to fix mod files is here: 
       https://sources.debian.org/src/eccodes/latest/debian/sanitize-mod/
timestamps_in_pdf_generated_by_rsvg_convert:
  description: |
    PDF files generated with rsvg-convert will contain CreationDate set to the
    current date and time.
    .
    Forwarded upstream https://gitlab.gnome.org/GNOME/librsvg/merge_requests/10
  deterministic: True
  url: https://bugs.debian.org/890027
randomness_in_berkeley_db_files:
  description: |
    Creating an empty Berkeley DB file (or ones with the same contents) results
    in a different file.
    .
    This comes from:
    https://sources.debian.org/src/db5.3/latest/src/os/os_uid.c/#L20 but
    it's unclear where to "set" this only on the creation case - we definitely
    want the uid to change if one adds stuff later.
    .
    Compounding this, the debugging tools *additionally* return random data for
    the uid/hash fields (!), so presumably srand is being called when you do a
    "db_dump -d a /path/to/my.db" which is obviously broken.
captures_build_path_in_mdb_files:
  description: |
    cli/mono packages can generate mdb files that contain build paths.
randomness_in_binaries_generated_by_golang:
  description: |
    Fixed upstream, but a new src:golang-go has not yet been uploaded to Debian.
  url: https://salsa.debian.org/go-team/packages/dh-golang/merge_requests/6
timestamps_in_preamble_generated_by_node_package_preamble:
  description: |
    node-package-preamble outputs the current date which is then included by a
    bunch of packages.
  url:
    https://github.com/mbostock/preamble/pull/4
random_order_in_javahelper_manifest_files:
  description: |
    javahelper writes MANIFEST.MF files with non-deterministic ordering.
  url: https://bugs.debian.org/893504
build_path_in_apertium_mode_files:
  description: |
    eg. lt proc path
nondeterminism_in_apertium_lrx_bin_files_generated_by_lrx_comp:
  description: |
    The lrx-comp utility from apertium-lex-tools generates bin files with
    nondeterministic contents.
nondeterminism_in_files_generated_by_hfst:
  description: |
    The hfst utilities generate non-deterministic .hfst files.
build_path_in_mip_files_generated_by_irafcl:
  description: |
    /usr/bin/irafcl from the iraf package creates .mip files with the absolute
    filename.
build_path_in_index_files_generated_by_qdoc:
  description: |
    eg. .index files have a filepath XML attribute.
member_search_index_json:
  description: |
    openjdk creates member-search-index.json files in zip files that appear to
    use the current time?
variations_from_march_native:
  description: |
    when packages invoke gcc or g++ with -march=native or -mcpu=native or
    -mtune=native, the resulting binaries will vary depending on the build
    system's CPU type. When such binaries are built on newer CPUs, they can
    cause segfaults when run on older CPUs due to invalid opcode.
    See also https://bugzilla.opensuse.org/show_bug.cgi?id=1100677
doxygen_fails_to_create_all_links_in_example_code:
  description: |
    doxygen-generated documentation *might* miss a few links to documented
    classes in example code.
python_sphinx_gallery_adds_timing_to_output:
  description: |
    Adds total running time to HTML and RST output. to HTML and RST output.
  url: https://bugs.debian.org/901307
jekyll_site_time_timestamp:
  description: |
    The Jekyll site generator uses Time.now as site.time.
  url: https://github.com/jekyll/jekyll/pull/7187
randomness_in_pdf2htmlex_html_output:
  description: |
    Converts PDFs to HTML, font headers are nondeterministic.
randomness_in_python_changelog_references:
  description: |
    The python-changelog library generates references in a nondeterministic order.
  url: https://bitbucket.org/zzzeek/changelog/pull-requests/1/please-make-the-references-reproducible/diff
cmake_rpath_contains_build_path:
  description: |
    When an executable is linked with a shared library from the same project,
    RPATH will contain the build path. Even if this is stripped on installation,
    the build-id will remain unchanged.
    .
    With CMake 3.14+, packages can set `-DCMAKE_BUILD_RPATH_USE_ORIGIN=ON` to
    fix the issue. This is done automatically when using the currently
    experimental debhelper compat level v14.
    https://cmake.org/cmake/help/latest/prop_tgt/BUILD_RPATH_USE_ORIGIN.html
    .
    When working with older CMake versions, the `CMAKE_SKIP_RPATH` option can be
    enabled instead, but it may be required to also set `LD_LIBRARY_PATH` while
    running tests.
  url: https://gitlab.kitware.com/cmake/cmake/issues/18413
build_path_in_texi_figure_documentation:
  description: |
    eg. "@float Figure,fig:qn_closed_single" in octave-queueing.
  deterministic: True
randomness_in_fonts_created_by_fontcustom:
  description: |
    fontcustom appears to embed the build date, some kind of version and some
    other randomness.
cflags_recorded_in_ada_ali_files:
  description: |
    The GCC Ada compiler writes build flags into
    /usr/lib/*/ada/adalib/*.ali, including *-prefix-map and hence the
    build path.
    .
    This is similar to build_path_captured_in_assembly_objects.
    Until BUILD_PATH_PREFIX_MAP is a reality,
    sed -i '/^A -f[a-z]\+-prefix-map=/d' debian/tmp/usr/lib/*/ada/adalib/*/*.ali
    Packages using dh-ada-library>=7.7 require no intervention.
    .
    Parent issue: records_build_flags
paths_vary_due_to_usrmerge:
  description: |
    eg. /bin/ vs /usr/bin/ or /lib vs. /usr/lib
timestamp_added_by_gnuradio_grcc:
  description: |
    .grc files are compiled by grcc and adds a Generated timestamp header that
    varies by timezone.
    .
    Code is in ./grc/core/generator/flow_graph.tmpl
  url: https://bugs.debian.org/914252
randomness_in_intercal_files:
  description: |
    dot io files
timestamps_embedded_in_manpages_by_scdoc:
  description: |
    YYYY-MM-DD
    .
    https://sources.debian.org/src/scdoc/latest/src/main.c/#L71
buildpath_in_binaries_generated_by_ada_compiler:
  description: |
    Hint: for music123, seems related with captures_build_path_via_assert.
randomness_in_ids_generated_by_org-html-publish-to-html:
  description: |
    eg. outline-container-orgb2aa480 vs outline-container-org7a7f99f
ftbfs_due_to_f-file-prefix-map:
  description: |
    An example of failure related to this are programs that expect
    __FILE__ to expand to some absolute path, but instead finding themselves
    a relative one.
    .
    In our unstable and experimental build systems we export
        DEB_BUILD_OPTIONS=reproducible=+all
    that makes dpkg-buildflags enable the reproducible/fixfilepath feature, adding
        -ffile-prefix-map=BUILDPATH=.
    to CFLAGS, CXXFLAGS, OBJCFLAGS, OBJCXXFLAGS, GCJFLAGS, FFLAGS and FCFLAGS.
randomness_in_postgres_opcodes:
  description: |
    randomness in bc files
buildpath_in_postgres_opcodes:
  description: |
    buildpath in bc files.
    .
    Possibly via using the source_filename variable in
    postgres*/src/tools/pgindent/pgindent.
timestamps_in_pdf_generated_by_daps:
  description: |
    PDF files generated with daps contain the CreationDate.
randomness_in_prolog_saved_stage:
  description: |
    `.pvm` files
build_path_in_typelib_files_generated_by_gir_compiler:
  description: |
    absolute build path
randomness_in_perl6_precompiled_libraries:
  description:
    See https://wiki.debian.org/Perl6PreCompProposal and
    https://bugs.debian.org/1002496 for more information.
build_date_in_egg_info_directory_name:
  description:
    setup.cfg file contains tag_date=true which results in date-specific egg-info dir.
randomness_in_output_from_perl_deparse:
  description:
    generates list of constants in nondeterministic order
randomness_in_fontconfig_uuid_files:
  description:
    This is usually a runtime problem but if fontconfig is called in a build it
    can effect build artifacts too. See
    https://redmine.tails.boum.org/code/issues/16732 and countless upstream
    threads.
codadef_coda_data_files:
  description:
    .codadef files are zip files but are not yet normalised by
    strip-nondeterminism (added 20190703 in 6a40d5dbfa).
timestamps_in_manpages_generated_by_lopsubgen:
  description:
    Uses localtime(3) instead of SOURCE_DATE_EPOCH.
  url: https://bugs.debian.org/931854
umask_in_java_jar_file:
  description:
    Permissions differ between builds
timezone_specific_files_due_to_haskell_devscripts:
  description:
    haskell-devscripts runs touch -d ... on very old files without an
    explicit timezone.
  url: https://bugs.debian.org/933834
captures_varying_number_of_build_path_directory_components:
  description:
    eg. /tmp/buildd/one/two vs /tmp/buildd/one/two/three can result in
    relative URIs (eg. ../../../usr/some/share/dir) differing.
embeds_build_data_via_node_preamble:
  description:
    eg "Copyright 2019 Mike Bostock"
  url: https://bugs.debian.org/935790
ghc_captures_build_path_via_tempdir:
  description: |
    A filename of the form "/tmp/ghcXXXX_0" is embedded into the binaries.
buildpath_in_code_generated_by_bison:
  description: |
    Without `--no-lines` (and I think `--name-prefix`) the output will include
    the absolute build path.
nondeterministic_defaults_in_documentation_generated_by_python_traitlets:
  description: |
    python-traitlets can generate .rst doctrings for various values. If the
    value is of their "Set" type, then the repr() value of this is
    nondeterministic.
  url: https://bugs.debian.org/942342
nondeterministic_devhelp_documentation_generated_by_gtk_doc:
  description: |
    gtk-doc can generate .devhelp2 files (or similar) with non-deterministic
    headers such as "Index of new API in 1.2.3".
    .
    Also random ordering?
  url: https://bugs.debian.org/946331
markdown_random_email_address_html_entities:
  description: |
    /usr/bin/markdown will use srand-om email addresses in HTML in an attempt to thwart
    spammers. This binary is provided by both markdown and
    libtext-markdown-perl which both have/had issues (see https://bugs.debian.org/947608
    for the former and https://bugs.debian.org/947708 for the latter)
  url: https://bugs.debian.org/947708
captures_build_path_via_haskell_adddependentfile:
  description: |
    adds build path in p_hi via addDependentFile
png_generated_by_plantuml_captures_kernel_version_and_builddate:
  description: |
    plantuml can generate PNG images of UML state diagrams. the iTXt component
    of these images contains a bunch of system properties that vary between
    build such as the OS Version (kernel version) as well as a timezone-varying
    date as part of plantuml's own version string identifier. See
    src/net/sourceforge/plantuml/version/Version.java etc.
random_identifiers_in_epub_files_generated_by_asciidoc:
  description: |
    The "a2x" tool from asciidoc appears to inject random bookId UUIDs or
    similar like _idm45416569061424 into the generated files.
dpkg-dev_extracts_origtgz_with_bad_permissions:
  description: |
    dpkg-dev uses 0777 instead of the permissions in the orig tarball
    when extracting (after umask filtering), so the permission bits of
    files in the working copy are wrong; this can affect archives
    created at build time from these files
  url: https://bugs.debian.org/796257
build_path_in_code_generated_by_dgbus_codegen:
  description: |
    C ifdefs use the absolute build path (eg. ___BUILD_1ST_PACKAGE_1.0)
random_argument_handling_in_javatools_jh_build:
  description:
    Conflict in handling of -o option leads to nondeterministic behaviour.
  url: https://bugs.debian.org/951573
openstack_pkg_tools_python_shebang_and_dependencies:
  description:
    Timing/race etc. causing nondeterminstic shebangs and package dependencies.
  url: https://bugs.debian.org/952762
nondeterministic_gtk_icon_cache:
  description:
    Possible filesystem ordering or hash table nondeterminism.
  url: https://bugs.debian.org/953105
nondeterministic_vo_files_generated_by_coq:
  description:
    Unknown source in .vo files generated by some Coq tool.
captures_build_path_in_vo_files_generated_by_coq:
  description:
    Build path embedded in .vo files generated by some Coq tool.
nondeterministic_checksum_generated_by_coq:
  description:
    /var/lib/coq/md5sums/packagename.checksum contains a short, nondeterminstic string.
captures_build_path_in_hd5_database_files:
  description:
    Absolute build path stored in headers, see h5py. Might be caused by
    libhdf5-dev low-level itself.
ros_dynamic_reconfigure_captures_build_path:
  description:
    eg. srcfile as well as other reference to the original source files.
uids_gids_in_tarballs_generated_by_cmake_kde_package_app_templates:
  description:
    eg. kde_package_app_templates(...)
    https://api.kde.org/ecm/kde-module/KDEPackageAppTemplates.html
    captures users, umask, etc.
gem2deb_install_mkmf_log:
  description:
    gem2deb is meant to remove mkmf.log files since 2014 but some packages
    still install it.
  url: https://bugs.debian.org/964772
nondeterministic_order_of_debhelper_snippets_added_by_dh_fortran_mod:
  description:
    iterates over Fortran compilers in a non-deterministic order
  url: https://bugs.debian.org/965255
nondeterministic_version_generated_by_python_param:
  description:
    python3-param will parse the version differently between the two builds
    when the toplevel directory does not match package-version format.
captures_build_path_via_quicktest_h_qml:
  description:
    quicktest.h-based tests capture the absolute build path. Possibly via
    QTEST_SET_MAIN_SOURCE_PATH in qtdeclarative5-dev.
rollup_embeds_build_path:
  description: |
    rollup generates module files that embed the buildpath.
    .
    eg. var moduleName_some_directory_components = module;
        return moduleName;
build_path_captured_by_nim:
  description: |
    nim appears to embed absolute paths to source files, possibly
    as part of assert-style debugging?
build_path_captured_by_octave:
  description: |
    octave packages embed the build path, typically with a /src suffix.
build_path_captured_by_pyuic5:
  description: |
    "Form implementation generated from reading ui file '%s'"
build_path_captured_by_rust:
  description: |
    rustlang seems to embed full build paths in various ways.
build_path_in_direct_url_json_file_generated_by_flit:
  description: |
    '{"url": "file://build/path", "dir_info": {"editable": false}}'
timestamps_in_3d_files_created_by_survex:
  description: |
    cave surveying files appear to have a UNIX timestamp in their headers
build_path_added_by_src2man_from_txt2man:
  description: |
    eg. "Extracted by src2man from /build/path/file.h"
build_path_in_record_file_generated_by_pybuild_flit_plugin:
  description: |
    The flit plugin for pybuild includes the build path into the RECORD file
    if it fails to transform the path into a relative one
    .
    See also https://salsa.debian.org/python-team/tools/dh-python/-/merge_requests/17
  url: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969352
build_path_in_header_generated_by_glib_genmarshal:
  description: |
    glib-genmarshal includes the build path in code comments by default,
    e.g. BOOLEAN:INT,INT,BOXED (%s). It should be invokved with
    --skip-source to omit these.
random_uuid_in_notebooks_generated_by_nbsphinx:
  description: |
    alt HTML tag generated by uuid.uuid4().hex
    https://sources.debian.org/src/nbsphinx/0.8.0+ds-1/src/nbsphinx.py/#L1315
  url: https://sourceforge.net/p/docutils/mailman/message/58746996/
kodi_package_captures_build_path_in_source_filename_hash:
  description: |
    kodi-* packages sometimes have strange paths like SIDCodec.cpp.b78d5642 in
    the binary (without the build path). The string suffix does not vary
    between builds in the same build path, suggesting its a hash of the build
    path.
    .
    Disabling Link-Time Optimization (LTO) and/or Debug Fission solves this
    issue.
  url: https://salsa.debian.org/multimedia-team/kodi-media-center/kodi-audiodecoder-fluidsynth/-/commit/ec87abd2c45b6c18f36352c049dfdf425f3a0911
timestamps_in_documentation_generated_by_mandoc:
  description: |
    mandoc (src:mdocml) generates manual pages using the current date. It
    interpolates a Mdocdate variable in manual pages, for instance.
absolute_path_in_cmake_file_generated_by_meson:
  description: |
    The meson build system can generate .cmake files, but they can contain
    absolute pathnames. The exact equivalent line in Cmake itself strips
    the path component.
  url: https://bugs.debian.org/1000327
random_temporary_filenames_embedded_by_mesonpy:
  description: |
    The mesonpy build system plugin (?) builds .so shared objects in a ./meson-XXXXX
    temporary filename, so even with CFLAGS correctly passing prefix-map etc.
    the generated binaries are nondeterministic.
non_deterministic_doc_base_file_for_javadoc:
  description: |
    Some packages have both a hand-written .doc-base file and a .doc-base
    file generated from Javadoc, and non-deterministically install one
    or the other. Example: https://bugs.debian.org/1001218
dynstr_section_longer_by_two_bytes_which_are_NULs:
  description: |
    The .dynstr section on the right build is longer by two bytes.
    The value of those two bytes is 0x00 0x00.
    .
    stlink=1.7.0+ds-1 is currently in both bullseye and sid; is reproducible on
    the former but not on the latter; and has this issue.  The issue could be
    caused by a difference in some build dependency between the two suites (for
    some common build dependency of all packages having this issue); or by
    a difference in the variations tested in the two suites.
    .
    The only difference in variations (per current "Variations tested" page) is
    the build path variation.
    .
    If the package uses the cmake buildsystem, this is likely a form
    of cmake_rpath_contains_build_path issue.
    .
    So, is there any any chance that this issue is caused by the build path
    variation?  <wild speculation>Perhaps the number of extra bytes is 2
    because the build path in build #2 is two bytes longer than in build
    #1?</wild speculation>
erlang_escript_file:
  description:
    Possible inline ZIP file.
extended_attributes_in_jar_file_created_without_manifest:
  description: |
    Creating a jar file with the -M flag causes jar(1) to add extended
    attributes to the last file added to the archive. As files are not added in
    a deterministic order (if, say, a directory is specified on the
    command-line), this means that even if the files are subsequently sorted,
    the extended attribute is moved around independently as well. First seen
    in src:threeb via
    https://salsa.debian.org/reproducible-builds/strip-nondeterminism/-/issues/19.
    Submitted to upstream - "We will review your report and have assigned it an
    internal review ID 9073223"
  url: https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8286712
mono_mastersummary_xml_files_inherit_filesystem_ordering:
  description: |
    Generated by mono.
  url: https://bugs.debian.org/1010854
ada_gprbuild_gcc_records_temp_paths:
  description: |
    In the -dbgsym package for an Ada library, the output of
    readelf --debug-dump=info /usr/lib/usr/lib/debug/.build-id/*/*.debug
    matches
    DW_AT_producer GNU Ada -g -gnate[cm]=/tmp/GNAT-TEMP-[digits].TMP
    .
    The files are created by gprbuild for GCC subprocesses.
    The enumeration order varies during parallel builds.
    This issue differs from gcc_captures_build_path and cannot be
    solved by *-file-prefix-map.
    .
    Fix: pass -cargs:ada -gno-record-gcc-switches -gargs to gprbuild.
    Packages using debian_packaging.mk from gnat>=11.2 require no
    intervention.
ada_gpr_embeds_build_path:
  description: |
    dh-ada-library writes -l options into a .gpr file, but also
    unwanted local -L options.
nondetermistic_js_output_from_webpack:
  description: |
    Compressed Javascript generated by webpack uses arbitrary numbers when
    minifying code. Unknown cause.
nondeterministic_ids_in_html_output_generated_by_python_sphinx_panels:
  description: |
    python3-sphinx-panels generates unique identifiers using uuid4, resulting
    in documentation that is not reproducible.
  url: https://bugs.debian.org/1017475
haskell_abi_hash_differences:
  description: |
    the interface/abi hash in .hi files differs between builds. Curiously, the
    order of these fields appears to differ too, but that might be downstream
    of the former issue.
usr_lib_debug_dotdwz_dir_inherits_build_user:
  description: |
    /usr/lib/debug/.dwz/i386-linux-gnu/ inherits the build user from the
    surrounding environment. Unknown source.
uid_variation_in_dbgsym_packages:
  description: |
    Unknown cause. Might be 32-bit specific.
python_module_embeds_build_path_in_empty_dirs:
  description: |
    eg. /build/1st/python-installer-0.5.1+dfsg1/debian/python3-installer/usr/bin/
    Unknown cause. Recent (~2022-11-10) regression? Does not end up on
    installed system as they are empty directories.
manpages_generated_by_node_marked_man_vary_on_build_timezone:
  description: |
    Occurs if SOURCE_DATE_EPOCH is +/- 12 hours of month changeing over (and
    build timezones are deliberately extreme)
  bugs: https://bugs.debian.org/1030724
build_path_in_line_annotations_added_by_ruby_ragel:
  description: |
    ragel is a library to compile finite state machines into code, similar to
    Bison/YACC etc. It can add line annotations that use the absolute build
    path.
    .
    This can be disabled by appending the `-L` flag when calling ragel.
timestamp_in_documentation_using_sphinx_zzzeeksphinx_theme:
  bugs: https://bugs.debian.org/1042955
  description: |
    zzzeeksphinx includes a 'Documentation last generated: ${datetime.datetime.now().strftime("%c")}'
nondeterminstic_order_of_pkgconfig_dependencies_generated_by_meson:
  url: https://bugs.debian.org/1056117
  description: |
    eg. "Requires.private: pixman-1, aml >= 0.3.0, aml < 0.4.0, […]"
    vs "Requires.private: pixman-1, aml < 0.4.0, aml >= 0.3.0, […]"
    Code is in `mesonbuild/modules/pkgconfig.py` in `src:meson`.
unsorted_cache_file_by_vlc-cache-gen:
  description: |
    File lists are generated in the plugins.dat file, which varies
    with the readdir() order.
timestamps_added_by_librime:
  description: |
    Rime Input Method Engine (RIME) related packages that use src:librime can
    ship YAML schema files with embedded timestamps.
    .
    There appears to be an optional configuration variable in rime,
    -DRIME_NO_TIMESTAMP, to disable this at runtime.
ordering_differences_in_pkg_info:
  description:
    setuptools does sort Requires-Dist in PKG-INFO files, leading to
    nondetermistic datastructures being serialised. This may be a Python 3.12
    ~regression now that a (patched?) pkg_resources is not being used anymore?
  bugs: https://bugs.debian.org/1077601
date_added_to_pom_properties_by_felix_bundleplugin:
  description:
    look for "#Generated by org.apache.felix.bundleplugin"
