Recently I had a bad memory module in my main storage system which is also the backup target of many of my systems. To be on the safe side, I validated all backed up files against their origin via checksums. Interestingly, multiple systems showed differing checksums for all DejaVu font files, i.e. the files in the backup did not match those in the system. Clearly, this was not caused by the bad memory module. It looked very much like a systematic issue.
I (and many others, I presume) use rsync for backups. By default, rsync identifies modified files by looking at modification time and size of the files. If files change without either of those attributes changing, rsync won’t transfer the file again. And that’s where bad Makefiles come into play…
dejavu-fonts include a command in nearly all of their Makefile targets that sets the modification time of the compiled targets to the modification time of their sources:
touch -r $< $@
It causes the created target files to inherit the modification time of the source file. This leads to all builds based on that release to create files with the same size and modification date. In particular, this is true for distributions packaging those files. And this explains my bad backups. From Debian Buster to Debian Bullseye there were no changes in size or modification date, although files changed of course:
Buster:
% ls -la usr/share/fonts/truetype/dejavu insgesamt 2816 drwxr-xr-x 1 bevan bevan 218 16. Aug 2016 . drwxr-xr-x 1 bevan bevan 12 16. Aug 2016 .. -rw-r--r-- 1 bevan bevan 757076 30. Jul 2016 DejaVuSans.ttf -rw-r--r-- 1 bevan bevan 340712 30. Jul 2016 DejaVuSansMono.ttf -rw-r--r-- 1 bevan bevan 331992 30. Jul 2016 DejaVuSansMono-Bold.ttf -rw-r--r-- 1 bevan bevan 705684 30. Jul 2016 DejaVuSans-Bold.ttf -rw-r--r-- 1 bevan bevan 380132 30. Jul 2016 DejaVuSerif.ttf -rw-r--r-- 1 bevan bevan 356088 30. Jul 2016 DejaVuSerif-Bold.ttf % sha1sum usr/share/fonts/truetype/dejavu/* 972d95e5549750e990a619b7b81ae5c3e2a5d973 usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf dc729355eb6bb3747295f923161983e0f526059e usr/share/fonts/truetype/dejavu/DejaVuSansMono-Bold.ttf 4d6f0dab51c91029837f4601bede9731df15a706 usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf ac33df1746a793891d9959285bcbd4ab1710a118 usr/share/fonts/truetype/dejavu/DejaVuSans.ttf c2d03a6e1905baeca92d7215654ce4385b62efae usr/share/fonts/truetype/dejavu/DejaVuSerif-Bold.ttf 044f0541973e0432f393372585c7dd3b1a94b816 usr/share/fonts/truetype/dejavu/DejaVuSerif.ttf
Bullseye:
% ls -la usr/share/fonts/truetype/dejavu insgesamt 2816 drwxr-xr-x 1 bevan bevan 218 22. Mai 2020 . drwxr-xr-x 1 bevan bevan 12 22. Mai 2020 .. -rw-r--r-- 1 bevan bevan 757076 30. Jul 2016 DejaVuSans.ttf -rw-r--r-- 1 bevan bevan 340712 30. Jul 2016 DejaVuSansMono.ttf -rw-r--r-- 1 bevan bevan 331992 30. Jul 2016 DejaVuSansMono-Bold.ttf -rw-r--r-- 1 bevan bevan 705684 30. Jul 2016 DejaVuSans-Bold.ttf -rw-r--r-- 1 bevan bevan 380132 30. Jul 2016 DejaVuSerif.ttf -rw-r--r-- 1 bevan bevan 356088 30. Jul 2016 DejaVuSerif-Bold.ttf % sha1sum usr/share/fonts/truetype/dejavu/* 97b46ca8305d6fc019558536bf40586aad04ea43 usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf c56fdb391863c7b8052b030438376e0b4692c405 usr/share/fonts/truetype/dejavu/DejaVuSansMono-Bold.ttf 8051a43f99bbeafa4c03ea7e94fef339044202e7 usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf e9c10fb809974382e5c8bbfde0314002daabe705 usr/share/fonts/truetype/dejavu/DejaVuSans.ttf c0db91e7dfa72f3dc198c09a8f5c78721328f833 usr/share/fonts/truetype/dejavu/DejaVuSerif-Bold.ttf 30f56053fbe320f6ce134bd8c18cf4a6e734299f usr/share/fonts/truetype/dejavu/DejaVuSerif.ttf
For Debian, this issue has been reported as Bug #1032599 and it has now been fixed by touching all compiled files. Still, as a general rule, please don’t fake modification dates in any of your Makefiles…