Hi Muhammad, others already explained how packaging VCS are (sadly) basically a free-for-all in Debian and that you will probably not get anything better than some heuristics. I wanted to add some more ideas to the ones that were already presented. So in addition to what was already said you can also try any of the following: 1. If the packaging is on salsa and the commit contains a "closes: XXXX" line, then the bug will contain a message like this one which will let you directly identify the commit that fixed the bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907352#39 2. If the changelog entry only closes the reproducible bug and nothing else, then you can use snapshot.d.o and then debdiff the version that closed the bug with the version before that. This method will work even for packages that are not using any VCS. 3. If the changelog closes multiple bugs but also points out *who* closed the reproducible bug and that person changed nothing else according to d/changelog then it's also easy to find the commit. This of course only works if the package does use a VCS and if your tools can detect and understand the specific packaging style that was used. 4. There were GSoC projects involving reproducible builds. For example Maria Valentina Marin Rodrigues contributed back in 2015 and if you find a commit of her in packaging repos it will be fixing a reproducible builds bug. There might be more GSoC students for which you can apply a similar approach. Just my 2c. Thanks! cheers, josch
Attachment:
signature.asc
Description: signature