In the build_pkg call in input_files, we were setting the output_dir option to the project's directory, causing this directory to be incorrectly used as the output directory in some cases. But there is no need to set output_dir at this point, so we can just remove it. We also introduce a new feature allowing to set options for the current project but not for the child projects listed in `input_files`. By default the options are applied recursively to all projects. If some options are defined under `norec/` then they are only applied on the current project. We use this feature in two places where we were setting the output_dir, which removes the need to reset it in two places. At the same time, we fix the `urlget()` call in input_files which was incorrectly ignoring options.
See https://wiki.debian.org/ReproducibleBuilds/TimestampsInGzipHeaders Thanks to boklm for helping with this patch.
When checking the signature on a tag, we also need to check that the tag is really the expected tag in order to avoid rollback attacks. Thanks to Santiago Torres-Arias and Keving Gallagher from NYU for reporting and helping to fix this issue.
The reason we don't run |git checkout --detach| in all cases is that it fails when we cloned a repository without a master branch. To avoid running it in this case, we were checking if HEAD is pointing to a branch which has a corresponding file in the .git directory. However it seems there are other cases where HEAD is pointing to a branch which does not have a corresponding file in the .git directory. Instead we now check that |git rev-parse --verify HEAD| does not return an error, in which case we assume that |git checkout --detach| will not produce an error too.
Set DEBIAN_FRONTEND=noninteractive when using apt-get in install_package. Also use the -q (quiet) argument.
We replace a call to: git submodule update --init with calls to: git submodule init git submodule sync git submodule update The call to `git submodule sync` is solving the issue that could occur when a submodule URL is changing.
To create an archive containing all submodules, we were creating a temporary archive of each submodule before appending them to the main archive. We were using the submodule path in the temporary archive filename, which was failing if the submodule is in a subdirectory. To avoid that, we are removing the path from the temporary archive's filename and directly appending it to the main archive.
By default gpg will from time to time update its trust database. When this happens it will also modify the keyring files to add some trust information. To avoid this we add the --no-auto-check-trustdb option. As we don't use the Web of Trust when we use a keyring file, we also disable it using `--trust-model always`.