Notes for innoextract - reproducible builds result

Version annotated: 1.8-1
Identified issues:
Identifier: captures_build_path_via_assert
Description Absolute paths to source file names are embedded through assert(), which
embeds the value of the __FILE__ macro in the .data section, or via
filenames in debug symbols, which shows in the .text and .debug_str sections.
.
We have a pending patch to GCC to fix this in one central place.
.
https://gcc.gnu.org/ml/gcc-patches/2016-11/msg00182.html
.
If/when this is accepted, this issue should be fixed for all packages and
you should not need to fix it specifically in your package.
.
For more background information see:
.
• https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160822/006788.html
• https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160905/006984.html
• https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160912/007076.html
Identifier: kodi_package_captures_build_path_in_source_filename_hash
URL https://salsa.debian.org/multimedia-team/kodi-media-center/kodi-audiodecoder-fluidsynth/-/commit/ec87abd2c45b6c18f36352c049dfdf425f3a0911
Description kodi-* packages sometimes have strange paths like SIDCodec.cpp.b78d5642 in
the binary (without the build path). The string suffix does not vary
between builds in the same build path, suggesting its a hash of the build
path.
.
Disabling Link-Time Optimization (LTO) and/or Debug Fission solves this
issue.
 

Our notes about issues affecting packages are stored in notes.git and are targeted at packages in Debian in 'unstable/amd64' (unless they say otherwise).