Notes for open-build-service - reproducible builds result

Version annotated: 2.7.1-1
Identified issues:
Identifier: bin_sh_is_bash
Description Various issues that are caused from whether /bin/sh is dash or bash.
Comments: [amd64/experimental]
1. Captures build date by restility:
docs/api/restility/lib/rest_htmlprinter.rb:22: @html.comment! "This file was generated by restility at #{Time.now}"
.
2. /usr/share/obs/api/public/assets/.sprockets-manifest-${md5sum}.json differs because mtimes inside are rendered in the local timezone:
│ │ │ │ │ - "mtime": "2016-06-02T23:07:43-12:00",
│ │ │ │ │ + "mtime": "2016-06-04T01:07:43+14:00",
Consequently, the ${md5sum} part of the filename differs, too.
.
3. Stray braces in filenames:
│ │ │ │ -drwxr-xr-x 0 root (0) root (0) 0 2016-09-16 22:54:06.000000 ./usr/share/obs/api/db/sphinx{,/
│ │ │ │ -drwxr-xr-x 0 root (0) root (0) 0 2016-09-16 22:54:06.000000 ./usr/share/obs/api/db/sphinx{,/production}/
│ │ │ │ +drwxr-xr-x 0 root (0) root (0) 0 2016-09-16 22:54:06.000000 ./usr/share/obs/api/db/sphinx/
│ │ │ │ +drwxr-xr-x 0 root (0) root (0) 0 2016-09-16 22:54:06.000000 ./usr/share/obs/api/db/sphinx/production/
.
due to brace expansion in a Makefile (works in bash but not in dash):
.
src/api/Makefile:17: $(INSTALL) -m 0755 -d $(DESTDIR)$(OBS_API_PREFIX)/db/sphinx{,/production}
 

Our notes about issues affecting packages are stored in notes.git and are targeted at packages in Debian in 'unstable/amd64' (unless they say otherwise).