For simplification, we remove some unused features. Those features can still be reimplemented externally if needed. We remove the following options: - version_command - rpm - srpm - rpmspec - rpm_rel - debian_create - deb - deb_src - use_pbuilder - debian_revision - options And the following commands: - rpmspec - rpm - srpm - deb-src - deb - pkg - publish
When using the build command, step gets initialized to 'build'. However this was not done in some of the other non-build commands where the value of step was left to rbm_init.
Instead, use the sha256file functon, which keeps the sha256sum of files to avoid computing it twice. The function can now take a HASH as a second argument, which can contain the key remove_cache indicating that the sha256sum of a file should be cleared: we use this when we find that a file has the wrong checksum and needs to be downloaded again.
In the build_pkg call in input_files, we were setting the output_dir option to the project's directory, causing this directory to be incorrectly used as the output directory in some cases. But there is no need to set output_dir at this point, so we can just remove it. We also introduce a new feature allowing to set options for the current project but not for the child projects listed in `input_files`. By default the options are applied recursively to all projects. If some options are defined under `norec/` then they are only applied on the current project. We use this feature in two places where we were setting the output_dir, which removes the need to reset it in two places. At the same time, we fix the `urlget()` call in input_files which was incorrectly ignoring options.
See https://wiki.debian.org/ReproducibleBuilds/TimestampsInGzipHeaders Thanks to boklm for helping with this patch.
When checking the signature on a tag, we also need to check that the tag is really the expected tag in order to avoid rollback attacks. Thanks to Santiago Torres-Arias and Keving Gallagher from NYU for reporting and helping to fix this issue.