issues.yml

@@ -21,7 +21,7 @@ timestamps_from_cpp_macros_in_haskell:
     The Haskell compiler also support C-like `__DATE__` and `__TIME__` macros, which
     embed the build time/date into the object files.
     .
-    eg. https://sources.debian.net/src/darcs/2.12.0-1/darcs/darcs.hs/#L85
+    eg. https://sources.debian.net/src/darcs/latest/darcs/darcs.hs/#L85
   deterministic: True
 timestamps_in_cpio_archive:
   description: |
@@ -112,7 +112,7 @@ timestamps_in_ps_generated_by_dvips:
   description: |
     eg. %%CreationDate (or DVIPSSource?) in header
     .
-    https://sources.debian.net/src/texlive-bin/2016.20160513.41080-4/texk/web2c/pdftexdir/pdftex.web/#L14449
+    https://sources.debian.net/src/texlive-bin/latest/texk/web2c/pdftexdir/pdftex.web/#L14449
     .
     DVIPSSource date Can be set to SOURCE_DATE_EPOCH by setting FORCE_SOURCE_DATE to 1.
   deterministic: True
@@ -161,7 +161,7 @@ randomness_in_documentation_generated_by_scilab:
     .
      <span·class="top"><a·href="section_be5547c931fe4d46ae907fad928a7cc2.html">ANN·toolbox</a></span>
     .
-    Source is likely https://sources.debian.net/src/scilab/5.5.2-2/modules/helptools/macros/xmltoformat.sci/#L1569
+    Source is likely https://sources.debian.net/src/scilab/latest/modules/helptools/macros/xmltoformat.sci/#L1569
 randomness_in_documentation_generated_by_epydoc:
   description: |
     Epydoc will add timestamps to the HTML file it produces. It can also generates
@@ -275,14 +275,14 @@ random_order_in_documentation_generated_by_javadoc:
     jdk9_dev/langtools/src/jdk.javadoc/share/classes/com/sun/tools/javadoc/DocLocale.java +172
     .
     Workaround is
-    https://sources.debian.net/src/maven-debian-helper/2.1.3/share/cdbs/1/class/maven.mk/?hl=136#L136
+    https://sources.debian.net/src/maven-debian-helper/latest/share/cdbs/1/class/maven.mk/?hl=136#L136
 nondeterministic_java_bytecode:
   description: |
     Source unknown.
 timestamps_in_documentation_generated_by_groovydoc:
   description: |
     Groovydoc will add timestamps to the HTML file it produces.
-    https://sources.debian.net/src/groovy/1.8.6-4/src/main/org/codehaus/groovy/tools/groovydoc/gstringTemplates/topLevel/index-all.html/#L19
+    https://sources.debian.net/src/groovy/latest/src/main/org/codehaus/groovy/tools/groovydoc/gstringTemplates/topLevel/index-all.html/#L19
   deterministic: True
 timestamps_in_jar:
   description: |
@@ -334,8 +334,8 @@ randomness_in_documentation_generated_by_lua_ldoc:
 timestamps_in_documentation_generated_by_lua_ldoc:
   description: |
     lua-ldoc adds build timestamp, varying by the timezone
-    https://sources.debian.net/src/lua-ldoc/1.4.3-1/ldoc/html/ldoc_ltp.lua/?hl=293#L293
-    https://sources.debian.net/src/lua-ldoc/1.4.3-1/ldoc.lua/?hl=784#L784
+    https://sources.debian.net/src/lua-ldoc/latest/ldoc/html/ldoc_ltp.lua/?hl=293#L293
+    https://sources.debian.net/src/lua-ldoc/latest/ldoc.lua/?hl=784#L784
   deterministic: True
   url: https://bugs.debian.org/820240
 pdf_created_by_ghostscript:
@@ -352,7 +352,7 @@ serial_numbers_in_ogg_via_sox:
   description: |
     Ogg streams must include unique serial numbers. By default sox includes
     a random serial number in the header.
-  url: https://sources.debian.org/src/sox/14.4.2-3/src/vorbis.c/#L334
+  url: https://sources.debian.org/src/sox/latest/src/vorbis.c/#L334
 timestamps_in_pdf_generated_by_apache_fop:
   description: |
     PDF files generated with Apache FOP will contain CreationDate and
@@ -625,8 +625,8 @@ random_order_in_maven_plugin_xml:
     mvn plugin.xml (-plugin packages) is generated in a random order.
     .
     Should be fixed in 3.3-1.
-    https://sources.debian.net/src/maven-plugin-tools/3.2-2/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java/#L167
-    https://sources.debian.net/src/maven-plugin-tools/3.3-1/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java/#L166
+    https://sources.debian.net/src/maven-plugin-tools/latest/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java/#L167
+    https://sources.debian.net/src/maven-plugin-tools/latest/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java/#L166
   url: https://jira.codehaus.org/browse/MPLUGIN-261
 timestamps_in_documentation_generated_by_edoc:
   description: |
@@ -644,7 +644,7 @@ timestamps_in_qch:
     generator is using various file IDs which become non-determinstic due to
     map access. For example
     .
-    https://sources.debian.net/src/qt4-x11/4:4.8.7%2Bdfsg-3/tools/assistant/lib/qhelpgenerator.cpp/?hl=742#L742
+    https://sources.debian.net/src/qt4-x11/latest/tools/assistant/lib/qhelpgenerator.cpp/?hl=742#L742
     .
     I suspect we just need a few sorts (and some time to build qt4-x11...)
   url: https://wiki.debian.org/ReproducibleBuilds/TimestampsInDatabaseGeneratedByQhelpgenerator
@@ -742,7 +742,7 @@ build_path_in_qdoc:
 randomness_in_qdoc:
   description: |
     Non-deterministic order of <tag> and <file> elements in XML. See
-    https://sources.debian.net/src/qtbase-opensource-src/5.3.2%2Bdfsg-4/src/tools/qdoc/helpprojectwriter.cpp/?hl=630#L787
+    https://sources.debian.net/src/qtbase-opensource-src/latest/src/tools/qdoc/helpprojectwriter.cpp/?hl=630#L787
     etc.
 randomness_in_qdoc_page_id:
   description: |
@@ -1069,19 +1069,19 @@ timestamps_in_documentation_generated_with_libwibble:
   description: |
     libwibble can generate manpages for applications using it.
     While doing so, it embeds the current date into the manpage.
-  url: https://sources.debian.net/src/libwibble/1.1-1/wibble/commandline/doc.cpp/#L320
+  url: https://sources.debian.net/src/libwibble/latest/wibble/commandline/doc.cpp/#L320
   deterministic: True
 copyright_year_in_documentation_generated_by_sphinx:
   description: |
     Sphinx is embedding the current year into copyright statements in generated documentation.
   See also: https://bugs.debian.org/820895
-  url: https://sources.debian.net/src/sphinx/1.3.1-8/sphinx/themes/basic/layout.html/#L191
+  url: https://sources.debian.net/src/sphinx/latest/sphinx/themes/basic/layout.html/#L191
 timestamps_in_documentation_generated_by_glib_genpod:
   description: |
     Glib::GenPod in libglib-perl generates POD documentation that embeds
     the current year in a copyright notice.
     .
-    https://sources.debian.net/src/libglib-perl/3:1.320-2/lib/Glib/GenPod.pm/#L43
+    https://sources.debian.net/src/libglib-perl/latest/lib/Glib/GenPod.pm/#L43
     .
     Fixed in libglib-perl 3:1.321-1.
   deterministic: True
@@ -1104,9 +1104,9 @@ timestamps_in_sym_l_files_generated_by_malaga:
     Malaga, a system for automatic language analysis, includes the current time
     in its output header files.
     .
-    https://sources.debian.net/src/malaga/7.12-5.2/malaga_files.h/#L34
-    https://sources.debian.net/src/malaga/7.12-5.2/malaga_files.c/#L79
-    https://sources.debian.net/src/malaga/7.12-5.2/malaga_files.c/#L88
+    https://sources.debian.net/src/malaga/latest/malaga_files.h/#L34
+    https://sources.debian.net/src/malaga/latest/malaga_files.c/#L79
+    https://sources.debian.net/src/malaga/latest/malaga_files.c/#L88
   deterministic: True
 timestamps_in_edj_files_generated_by_edje_cc:
   description:
@@ -1215,8 +1215,8 @@ ruby_mkmf_makefile_unsorted_objects:
     Many of those packages are likely affected:
     https://codesearch.debian.net/perpackage-results/path%3Aextconf.rb%20create_makefile/2/page_0
     .
-    ruby: https://sources.debian.net/src/ruby2.3/2.3.1-1/lib/mkmf.rb/#L2180
-    jruby: https://sources.debian.net/src/jruby/1.7.22-2/lib/ruby/shared/mkmf.rb/#L1488
+    ruby: https://sources.debian.net/src/ruby2.3/latest/lib/mkmf.rb/#L2180
+    jruby: https://sources.debian.net/src/jruby/latest/lib/ruby/shared/mkmf.rb/#L1488
   url: https://bugs.debian.org/825569
 timestamps_in_pdf_generated_by_imagemagick:
   description: |
@@ -1251,7 +1251,7 @@ cryptographic_signature:
 r_base_appends_built_header_to_description_files:
   description: |
     r-base appends "Built: blah" header to DESCRIPTION files.
-    https://sources.debian.net/src/r-base/3.3.1-1/share/make/basepkg.mk/#L101
+    https://sources.debian.net/src/r-base/latest/share/make/basepkg.mk/#L101
   deterministic: True
   url: https://bugs.debian.org/774031
 timestamps_in_documentation_generated_by_mkdocs:
@@ -1270,7 +1270,7 @@ random_order_of_pdf_ids_generated_by_latex:
     .
     (Might be caused by PSOutputDev::setupFonts in embedded poppler PDFDoc.cc)
     .
-    (Or http://sources.debian.net/src/texlive-bin/2017.20170613.44572-2/texk/web2c/pdftexdir/pdftex.web/#L20122-L20129)
+    (Or http://sources.debian.net/src/texlive-bin/latest/texk/web2c/pdftexdir/pdftex.web/#L20122-L20129)
     .
     (This might be tagged the same as random_id_in_pdf_generated_by_dblatex)
   url: http://tug.org/pipermail/tex-live/2017-June/040398.html
@@ -1302,7 +1302,7 @@ randomness_in_binaries_generated_by_sbcl:
 random_xspp_identifier_by_extutils_xspp:
   description: |
     ExtUtils::XSPP generates random identifiers that are included in generated C code.
-    https://sources.debian.net/src/libextutils-xspp-perl/0.1800-2/lib/ExtUtils/XSpp/Lexer.pm/#L141
+    https://sources.debian.net/src/libextutils-xspp-perl/latest/lib/ExtUtils/XSpp/Lexer.pm/#L141
     .
     Possible solution is seeding the rng with srand($SOURCE_DATE_EPOCH) in ExtUtils/XSpp/Cmd.pm.
 ftbfs_with_-fdebug-prefix-map_error:
@@ -1389,21 +1389,21 @@ perl_extutils_xspp_captures_build_path:
   description:
     ExtUtils::XSpp captures the build path in the headers.
     .
-    https://sources.debian.net/src/libmodule-build-withxspp-perl/0.14-2/lib/Module/Build/WithXSpp.pm/#L230
+    https://sources.debian.net/src/libmodule-build-withxspp-perl/latest/lib/Module/Build/WithXSpp.pm/#L230
   url: https://bugs.debian.org/835447
   deterministic: True
 href_links_mangled_by_node_marked:
   description:
     marked html-encodes email addresses in an unreproducible way.
     .
-    https://sources.debian.net/src/node-marked/0.3.2%2Bdfsg-1/lib/marked.js/#L740
+    https://sources.debian.net/src/node-marked/latest/lib/marked.js/#L740
 uname_output_in_python_debugging_symbols_caused_by_sysconfig_getplatform:
   description: |
     encoded in tempfile. Affects building on i386 as it does not distinguish
     between userland vs kernel.
     .
-    https://sources.debian.net/src/python2.7/2.7.12-2/Lib/sysconfig.py/#L572-L584
-    https://sources.debian.net/src/python3.5/3.5.2-3/Lib/sysconfig.py/#L646-L658
+    https://sources.debian.net/src/python2.7/latest/Lib/sysconfig.py/#L572-L584
+    https://sources.debian.net/src/python3.5/latest/Lib/sysconfig.py/#L646-L658
   url: https://bugs.debian.org/835805
   deterministic: True
 cython_captures_build_path:
@@ -1416,7 +1416,7 @@ timestamp_in_enc_files_added_by_texlive_fontinst:
    -%    date = "generated 2017/09/15",
    +%    date = "generated 2016/08/14",
    .
-   https://sources.debian.net/src/texlive-extra/2016.20160819-1/texmf-dist/tex/fontinst/base/finstmsc.sty/#L899
+   https://sources.debian.net/src/texlive-extra/latest/texmf-dist/tex/fontinst/base/finstmsc.sty/#L899
   deterministic: True
 random_id_in_pdf_generated_by_dblatex:
   description: |
@@ -1431,7 +1431,7 @@ random_id_in_pdf_generated_by_dblatex:
     .
     (This might be tagged the same as random_order_of_pdf_ids_generated_by_latex)
     .
-    (Or http://sources.debian.net/src/texlive-bin/2017.20170613.44572-2/texk/web2c/pdftexdir/pdftex.web/#L20122-L20129)
+    (Or http://sources.debian.net/src/texlive-bin/latest/texk/web2c/pdftexdir/pdftex.web/#L20122-L20129)
   url: http://tug.org/pipermail/tex-live/2017-June/040398.html
 random_order_in_sisu_javax_inject_named:
   description: |
@@ -1578,7 +1578,7 @@ nondeterminstic_ordering_in_casacore_tables:
   description: |
     src:casacore generates index.dat and table.f0 files with random order.
     .
-    I believe this is somewhere near http://sources.debian.net/src/casacore/2.1.0-3/tables/Tables/TableProxy.cc/?hl=1448#L1448
+    I believe this is somewhere near http://sources.debian.net/src/casacore/latest/tables/Tables/TableProxy.cc/?hl=1448#L1448
 translations_missing_in_desktop_files:
   description: |
     A file contains a list of «Name[xx] = "String"» lines, where «xx» is a language code;
@@ -1627,9 +1627,9 @@ formatdb_from_ncbi_blastplus_captures_build_time:
   description: |
     formatdb calls such as [1] capture the build time.
     The build time is captured in [2] and written out in [3].
-    [1] https://sources.debian.net/src/metastudent-data/2.0.1-2/Makefile.am/#L24
-    [2] http://sources.debian.net/src/ncbi-blast%2B/2.6.0-1/c%2B%2B/src/objtools/blast/seqdb_writer/writedb_impl.cpp/#L78-L87
-    [3] http://sources.debian.net/src/ncbi-blast%2B/2.6.0-1/c%2B%2B/src/objtools/blast/seqdb_writer/writedb_files.cpp/#L267
+    [1] https://sources.debian.net/src/metastudent-data/latest/Makefile.am/#L24
+    [2] http://sources.debian.net/src/ncbi-blast%2B/latest/c%2B%2B/src/objtools/blast/seqdb_writer/writedb_impl.cpp/#L78-L87
+    [3] http://sources.debian.net/src/ncbi-blast%2B/latest/c%2B%2B/src/objtools/blast/seqdb_writer/writedb_files.cpp/#L267
   deterministic: True
 randomness_in_t3g_files_generated_tslmendian:
   description: |
@@ -1664,7 +1664,7 @@ timestamp_in_jboss_messagebundle_generated_code:
     JBoss @MessageBundle (translation) generated classes contain a generation date and time. This
     timestamp is only retained in the generated code, so doesn't appear in the binary unless you
     generate documentation from it.
-    https://sources.debian.net/src/jboss-logging-tools/2.0.2-1/processor/src/main/java/org/jboss/logging/processor/generator/model/ClassModel.java/#L146
+    https://sources.debian.net/src/jboss-logging-tools/latest/processor/src/main/java/org/jboss/logging/processor/generator/model/ClassModel.java/#L146
   deterministic: True
 portable_executable_strong_name_varies:
   description: |
@@ -1674,7 +1674,7 @@ timestamps_in_manpages_created_by_libwibble:
     libwibble ("Library of various useful C++ code") can generate manpages but
     they use the current time.
     .
-    http://sources.debian.net/src/libwibble/1.1-1/wibble/commandline/doc.cpp/#L232
+    http://sources.debian.net/src/libwibble/latest/wibble/commandline/doc.cpp/#L232
   url: https://bugs.debian.org/861672
 timestamps_in_cbd_files_generated_by_canna_mkbindic:
   description: |
@@ -1769,7 +1769,7 @@ timestamps_in_rcc_files_generated_by_rcc:
     /usr/lib/qt5/bin/rcc from qtbase5-dev-tools (src qtbase-opensource-src)
     embeds a last modified timestamp in the generated .rcc file.
     .
-    http://sources.debian.net/src/qtbase-opensource-src/5.9.1%2Bdfsg-9/src/tools/rcc/rcc.cpp/#L207-L212
+    http://sources.debian.net/src/qtbase-opensource-src/latest/src/tools/rcc/rcc.cpp/#L207-L212
 nondeterminism_in_documentation_generated_by_pydoctor:
   description: |
     eg. non-deterministic HTML id attributes.
@@ -1782,7 +1782,7 @@ gfortran_mod_captures_build_path:
     gfortran generates .mod and .smod files that can capture the build path.
     A patch for gfortran : https://bugs.debian.org/889133
     Also, a small workaround script to fix mod files is here: 
-       https://sources.debian.org/src/eccodes/2.6.0-2/debian/sanitize-mod/
+       https://sources.debian.org/src/eccodes/latest/debian/sanitize-mod/
 timestamps_in_pdf_generated_by_rsvg_convert:
   description: |
     PDF files generated with rsvg-convert will contain CreationDate set to the
@@ -1797,7 +1797,7 @@ randomness_in_berkeley_db_files:
     in a different file.
     .
     This comes from:
-    https://sources.debian.org/src/db5.3/5.3.28-13.1/src/os/os_uid.c/#L20 but
+    https://sources.debian.org/src/db5.3/latest/src/os/os_uid.c/#L20 but
     it's unclear where to "set" this only on the creation case - we definitely
     want the uid to change if one adds stuff later.
     .
@@ -1930,7 +1930,7 @@ timestamps_embedded_in_manpages_by_scdoc:
   description: |
     YYYY-MM-DD
     .
-    https://sources.debian.org/src/scdoc/1.5.2-1/src/main.c/#L71
+    https://sources.debian.org/src/scdoc/latest/src/main.c/#L71
 buildpath_in_binaries_generated_by_ada_compiler:
   description: |
     Adb files?
@@ -1960,3 +1960,6 @@ randomness_in_prolog_saved_stage:
 build_path_in_typelib_files_generated_by_gir_compiler:
   description: |
     absolute build path
+randomness_in_perl6_precompiled_libraries:
+  description:
+    Pretty sure Debian shouldn't be shipping these, just like .pyc files.

packages.yml

@@ -182,6 +182,10 @@ adios:
   issues:
     - captures_shell_variable_in_autofoo_script
     - records_build_flags
+adms:
+  version: 2.3.6-2
+  bugs:
+    - 926298
 adplug:
   version: 2.2.1+dfsg3-0.3
   issues:
@@ -406,10 +410,6 @@ and:
   version: 1.2.2-4.1
   issues:
     - gcc_captures_build_path
-android-framework-23:
-  version: 6.0.1+r72-3
-  bugs:
-    - 894285
 android-platform-art:
   version: 8.1.0+r23-1
   issues:
@@ -2645,7 +2645,6 @@ clsparse:
   comments: |
     Both in doxygen docs and in asserts.
   issues:
-    - captures_build_path
     - captures_build_path_via_assert
 clsync:
   version: 0.4.2-1
@@ -2718,6 +2717,10 @@ coco-java:
   version: 20110419-3.1
   issues:
     - timestamps_in_jar
+coda:
+  version: 2.20-3
+  bugs:
+    - 926301
 code-saturne:
   version: 4.2.1+repack-1
   issues:
@@ -6042,6 +6045,10 @@ fs-uae:
   issues:
     - different_due_to_umask
     - timestamps_in_zip
+fscrypt:
+  version: 0.2.4-2
+  issues:
+    - build_id_differences_only
 fsharp:
   version: 3.1.1.26+dfsg2-2
   issues:
@@ -7049,6 +7056,10 @@ gmp:
   version: 2:6.1.2+dfsg-1
   issues:
     - build_path_captured_in_assembly_objects
+gmp-ecm:
+  version: 7.0.4+ds-5
+  issues:
+    - captures_build_path_via_assert
 gmrun:
   version: 0.9.2-2.1
   issues:
@@ -7861,8 +7872,6 @@ grantlee5:
   version: 5.1.0-2
   issues:
     - build_id_differences_only
-  bugs:
-    - 876852
 grap:
   version: 1.45-1
   bugs:
@@ -7967,6 +7976,10 @@ gron:
   version: 0.6.0-1
   issues:
     - golang_compiler_captures_build_path_in_binary
+groonga:
+  version: 9.0.1-1
+  comments: |
+    Seems to capture all environment/build variables, including CFLAGS
 groovebasin:
   version: 1.4.0-1
   issues:
@@ -8900,6 +8913,10 @@ input-utils:
   version: 1.0-1.1
   issues:
     - gcc_captures_build_path
+insserv:
+  version: 1.18.0-2
+  issues:
+    - captures_build_path_via_assert
 installation-guide:
   version: 20170312
   issues:
@@ -9585,7 +9602,6 @@ jruby:
     - timestamp_in_java_bnd_manifest
   bugs:
     - 849217
-    - 893244
 jruby-openssl:
   version: 0.9.11-2
   issues:
@@ -9706,6 +9722,10 @@ junior-doc:
     - timestamps_in_gzip_headers
     - different_encoding
     - timestamps_in_ps_generated_by_dvips
+jupyter-notebook:
+  version: 5.7.4-2.1
+  issues:
+    - randomness_in_documentation_underscore_downloads_generated_by_sphinx
 jxrlib:
   version: 1.1-6
   issues:
@@ -10423,6 +10443,10 @@ kparts:
   version: 5.25.0-1
   issues:
     - captures_build_path
+kpartsplugin:
+  version: 20120605-1
+  comments: |
+    I think this buildpath is somewhere in src/mimetypehelper.cpp
 kpat:
   version: 4:16.08.1-1
   issues:
@@ -12013,6 +12037,10 @@ libkgapi:
   version: 5.1.0-2
   issues:
     - build_id_differences_only
+libkiwix:
+  version: 3.1.1-1
+  comments: |
+    Captures absolute build path in binary by storing path to a results.tmpl file
 libkml:
   version: 1.3.0-3
   issues:
@@ -12215,6 +12243,10 @@ libmpd:
   version: 0.20.0-1.3
   issues:
     - gcc_captures_build_path
+libmstoolkit:
+  version: 82-6
+  issues:
+    - captures_build_path_via_assert
 libmthca:
   version: 1.0.6-1
   issues:
@@ -12537,10 +12569,6 @@ libqtdbusmock:
   version: 0.7+bzr49+repack1-1
   issues:
     - timestamps_in_h_generated_by_qdbusxml2cpp
-libqtdbustest:
-  version: 0.2+bzr42+repack1-2
-  bugs:
-    - 879937
 libqtxdg:
   version: 2.0.0-4
   issues:
@@ -13217,6 +13245,10 @@ lirc:
   version: 0.9.0~pre1-1.2
   issues:
     - captures_build_path
+listserialportsc:
+  version: 1.4.0-1
+  issues:
+    - captures_build_path_via_assert
 literki:
   version: 0.0.0+20100113.git1da40724-1.2
   issues:
@@ -14357,10 +14389,6 @@ mona:
     - captures_build_path
     - records_build_flags
     - libtool_captures_shell_build-flags_build-path_path-env
-mongo-c-driver:
-  version: 1.13.0-1
-  bugs:
-    - 920411
 mongo-tools:
   version: 3.2.11-1
   issues:
@@ -14515,6 +14543,10 @@ mopac7:
   version: 1.15-6
   issues:
     - gcc_captures_build_path
+morbig:
+  version: 0.9.1-2
+  issues:
+    - ocaml_captures_build_path
 moreutils:
   version: 0.60-1
   issues:
@@ -14682,6 +14714,10 @@ mtail:
   version: 0.0+git20160716.f911b02-1
   issues:
     - golang_compiler_captures_build_path_in_binary
+mtink:
+  version: 1.0.16-10
+  comments: |
+    binary includes absolute build path to $prefix/usr/doc
 mu-cade:
   version: 0.11.dfsg1-12
   issues:
@@ -14923,6 +14959,10 @@ nbibtex:
     - timestamps_in_ps_generated_by_dvips
   bugs:
     - 812704
+nbsphinx:
+  version: 0.4.2+ds-1
+  comments: |
+    calls numpy.random.randint, needs to be seeded via https://docs.scipy.org/doc/numpy/reference/generated/numpy.random.seed.html
 nbtscan:
   version: 1.5.1-6
   issues:
@@ -15030,6 +15070,10 @@ netcdf:
   version: 1:4.4.1-2
   issues:
     - records_build_flags
+netcdf-parallel:
+  version: 1:4.6.2-1
+  bugs:
+    - 926421
 netcf:
   version: 1:0.2.8-1
   issues:
@@ -15246,6 +15290,18 @@ ngs-sdk:
   version: 1.3.0-1
   bugs:
     - 813559
+ngspice:
+  version: 30.2-1
+  comments: |
+    Looks like lyx uses the absolute build path...
+nibabel:
+  version: 2.3.2-1
+  issues:
+    - randomness_in_documentation_underscore_downloads_generated_by_sphinx
+nifticlib:
+  version: 2.0.0-3
+  comments: |
+    docs contain absolute build path
 nipy:
   version: 0.3.0+git262-gbb838d7-1
   issues:
@@ -15277,10 +15333,6 @@ nitrokey-app:
   version: 0.6.1-1
   issues:
     - gcc_captures_build_path
-nitroshare:
-  version: 0.3.3-1
-  bugs:
-    - 881082
 nkf:
   version: 1:2.1.4-1
   issues:
@@ -15374,14 +15426,6 @@ node-loose-envify:
   version: 1.3.0+dfsg1-1
   issues:
     - timestamps_embedded_in_manpages_by_node_marked_man
-node-lunr:
-  version: 2.3.5~dfsg-6
-  bugs:
-    - 923169
-node-merge-stream:
-  version: 1.0.1-1
-  bugs:
-    - 854495
 node-mocha:
   version: 4.1.0+ds1-2
   issues:
@@ -15465,6 +15509,10 @@ not-yet-commons-ssl:
   version: 0.3.15-2
   issues:
     - random_order_in_documentation_generated_by_javadoc
+notary:
+  version: 0.6.1~ds1-3
+  comments: |
+    Generates test certificate at build/test time which gets installed to the binary package
 notify-python:
   version: 0.1.1-4
   issues:
@@ -16010,6 +16058,10 @@ octave-odepkg:
   version: 0.8.5-2
   issues:
     - random_order_of_pdf_ids_generated_by_latex
+octave-sparsersb:
+  version: 1.0.6-2
+  issues:
+    - captures_build_path_via_assert
 octave-tisean:
   version: 0.2.3-1
   bugs:
@@ -16268,7 +16320,6 @@ openhft-lang:
   version: 6.7.6-1
   bugs:
     - 844083
-    - 893495
 openhpi:
   version: 3.6.1-2.2
   issues:
@@ -17066,6 +17117,10 @@ perl4caml:
   version: 0.9.5-5
   issues:
     - ocaml_captures_build_path
+perl6-zef:
+  version: 0.6.2-1
+  issues:
+    - randomness_in_perl6_precompiled_libraries
 perlbal:
   version: 1.80-3
   bugs:
@@ -17110,6 +17165,10 @@ pg-comparator:
   version: 2.2.6-2
   issues:
     - gcc_captures_build_path
+pg-dirtyread:
+  version: 2.0-3
+  issues:
+    - randomness_in_postgres_opcodes
 pg-partman:
   version: 2.2.2-1
   issues:
@@ -17118,10 +17177,22 @@ pg-rage-terminator:
   version: 0.1.4-1
   issues:
     - gcc_captures_build_path
+pg-rational:
+  version: 0.0.1-1
+  issues:
+    - randomness_in_postgres_opcodes
 pg-repack:
   version: 1.3.4-1
   issues:
     - gcc_captures_build_path
+pg-similarity:
+  version: 1.0-2
+  issues:
+    - randomness_in_postgres_opcodes
+pg-snakeoil:
+  version: 1.1-1
+  issues:
+    - randomness_in_postgres_opcodes
 pgadmin3:
   version: 1.22.1-1
   issues:
@@ -17146,6 +17217,10 @@ pglogical:
   version: 2.2.1-4
   issues:
     - randomness_in_postgres_opcodes
+pglogical-ticker:
+  version: 1.3.1-1
+  issues:
+    - randomness_in_postgres_opcodes
 pgmemcache:
   version: 2.3.0-2
   issues:
@@ -17963,14 +18038,6 @@ php-xml-svg:
   version: 1.1.0-2
   issues:
     - timestamp_in_pear_registry_files
-php-zeta-base:
-  version: 1.9-3
-  bugs:
-    - 882917
-php-zeta-console-tools:
-  version: 1.7-3
-  bugs:
-    - 882920
 php7.0:
   version: 7.0.4-6
   comments: |
@@ -18760,6 +18827,10 @@ prometheus-mysqld-exporter:
   version: 0.8.1+ds-1
   issues:
     - golang_compiler_captures_build_path_in_binary
+prometheus-nginx-exporter:
+  version: 0.1.0-1
+  issues:
+    - randomness_in_binaries_generated_by_golang
 prometheus-nginx-vts-exporter:
   version: 0.10.3+git20180501.43b4556+ds-1
   issues:
@@ -18884,6 +18955,10 @@ publican:
   issues:
     - timestamps_in_epub
     - timestamps_in_pdf_generated_by_apache_fop
+puddletag:
+  version: 1.2.0-2
+  issues:
+    - randomness_in_documentation_underscore_downloads_generated_by_sphinx
 puf:
   version: 1.0.0-7
   issues:
@@ -19222,6 +19297,10 @@ pyside-tools:
   version: 0.2.15-1
   issues:
     - gcc_captures_build_path
+pysmi:
+  version: 0.3.2-1
+  issues:
+    - randomness_in_documentation_underscore_downloads_generated_by_sphinx
 pysurfer:
   version: 0.7-2
   comments: |
@@ -19871,11 +19950,6 @@ python3.5:
     - randomness_in_fat_lto_objects
     - records_build_flags
     - captures_build_arch
-python3.6:
-  version: 3.6.0~b2-1
-  issues:
-    - records_build_flags
-    - captures_build_arch
 python3.7:
   version: 3.7.1-1
   issues:
@@ -19912,10 +19986,6 @@ pyxb:
   version: 1.2.6+dfsg-1
   issues:
     - randomness_in_documentation_generated_by_sphinx
-pyxdg:
-  version: 0.25-4
-  bugs:
-    - 877202
 pyxmpp:
   version: 1.1.2-1
   issues:
@@ -20029,6 +20099,10 @@ qoauth:
   version: 2.0.1~1-3
   issues:
     - captures_build_dir_in_qmake_prl_files
+qpid-proton:
+  version: 0.22.0-3
+  bugs:
+    - 926300
 qps:
   version: 1.10.16+20151210-1
   issues:
@@ -21130,6 +21204,10 @@ r-cran-ellipse:
   version: 0.3-8-1
   issues:
     - randomness_in_r_rdb_rds_databases
+r-cran-ellipsis:
+  version: 0.1.0-1
+  issues:
+    - randomness_in_r_rdb_rds_databases
 r-cran-elliptic:
   version: 1.3-5-1
   issues:
@@ -21262,6 +21340,10 @@ r-cran-foreach:
   version: 1.4.3-1
   issues:
     - randomness_in_r_rdb_rds_databases
+r-cran-forecast:
+  version: 8.5-1
+  issues:
+    - randomness_in_r_rdb_rds_databases
 r-cran-formatr:
   version: 1.2.1-4
   issues:
@@ -21274,6 +21356,10 @@ r-cran-fpc:
   version: 2.1-11.1-1
   issues:
     - randomness_in_r_rdb_rds_databases
+r-cran-fracdiff:
+  version: 1.4-2-1
+  issues:
+    - randomness_in_r_rdb_rds_databases
 r-cran-fs:
   version: 1.2.6+dfsg-1
   issues:
@@ -21542,6 +21628,10 @@ r-cran-irace:
   version: 3.1-1
   issues:
     - randomness_in_r_rdb_rds_databases
+r-cran-irdisplay:
+  version: 0.7.0-1
+  issues:
+    - randomness_in_r_rdb_rds_databases
 r-cran-irlba:
   version: 2.0.0-1
   issues:
@@ -22593,6 +22683,10 @@ r-cran-shinybs:
   version: 0.61-1
   issues:
     - randomness_in_r_rdb_rds_databases
+r-cran-shinycssloaders:
+  version: 0.2.0-1
+  issues:
+    - randomness_in_r_rdb_rds_databases
 r-cran-shinydashboard:
   version: 0.6.1-1
   issues:
@@ -22882,6 +22976,10 @@ r-cran-urltools:
   version: 1.6.0-1
   issues:
     - randomness_in_r_rdb_rds_databases
+r-cran-uroot:
+  version: 2.0-9-1
+  issues:
+    - randomness_in_r_rdb_rds_databases
 r-cran-usethis:
   version: 1.4.0-1
   issues:
@@ -23412,6 +23510,10 @@ rig:
   version: 1.11-1
   issues:
     - gcc_captures_build_path
+ring:
+  version: 20190215.1.f152c98~ds1-1
+  comments: |
+    Embeds build path in binary via TOP_BUILDDIR preprocessor flag.
 ripmime:
   version: 1.4.0.10.debian.1-1
   comments: |
@@ -23674,6 +23776,10 @@ rtkit:
   version: 0.11-4
   issues:
     - gcc_captures_build_path
+rtklib:
+  version: 2.4.3+dfsg1-1
+  issues:
+    - captures_build_path_via_assert
 rtl-sdr:
   version: 0.5.3-11
   issues:
@@ -23859,6 +23965,10 @@ ruby-gd:
   version: 0.8.0-7
   issues:
     - gcc_captures_build_path
+ruby-github-linguist:
+  version: 6.4.0-2
+  issues:
+    - captures_build_path_via_assert
 ruby-github-markdown:
   version: 0.6.9-2
   issues:
@@ -23923,6 +24033,10 @@ ruby-json:
   version: 2.0.1+dfsg-2
   issues:
     - gcc_captures_build_path
+ruby-kgio:
+  version: 2.11.2-1
+  issues:
+    - captures_build_path_via_assert
 ruby-kyotocabinet:
   version: 1.32-2
   issues:
@@ -24035,6 +24149,10 @@ ruby-oj:
   version: 2.17.1-1
   issues:
     - gcc_captures_build_path
+ruby-openssl:
+  version: 2.1.2-1
+  issues:
+    - captures_build_path_via_assert
 ruby-ox:
   version: 2.1.1-2
   issues:
@@ -24081,6 +24199,10 @@ ruby-raindrops:
   version: 0.17.0-1
   issues:
     - gcc_captures_build_path
+ruby-rbtrace:
+  version: 0.4.10-1
+  issues:
+    - captures_build_path_via_assert
 ruby-rdiscount:
   version: 2.1.8-1
   issues:
@@ -24169,6 +24291,10 @@ ruby-text-table:
   version: 1.2.4-1
   bugs:
     - 795676
+ruby-thrift:
+  version: 0.11.0.0-1
+  issues:
+    - captures_build_path_via_assert
 ruby-timfel-krb5-auth:
   version: 0.8.3-2
   issues:
@@ -25486,6 +25612,10 @@ ssmtp:
     - timestamps_in_gzip_headers
   bugs:
     - 777398
+ssocr:
+  version: 2.19.0-2
+  issues:
+    - captures_build_path_via_assert
 st:
   version: 1.9-3.1
   bugs:
@@ -28024,6 +28154,10 @@ xlog:
   version: 2.0.13-2
   issues:
     - gcc_captures_build_path
+xlunzip:
+  version: 0.4-3
+  issues:
+    - captures_build_path_via_assert
 xmacro:
   version: 0.3pre-20000911-7
   issues:
@@ -28180,6 +28314,10 @@ xracer:
   version: 0.96.9.1-8
   issues:
     - gcc_captures_build_path
+xrdp:
+  version: 0.9.9-1
+  comments: |
+    Embeds build flags in binary so captures fprefixmap etc
 xscorch:
   version: 0.2.1-1+nmu1
   issues: