Make template tar.bz2's reproducible. (!238) · Merge requests · Frameworks / Extra CMake Modules

Emil Velikov requested to merge xexaxo/extra-cmake-modules:reproducible-tar into master Jan 31, 2022

This incorporates recommendations from https://reproducible-builds.org/docs/archives/ to better make tarballs reproducible. In some build environments like in Guix, the GID of "root" is not consistant.

With --numeric-owner, we only need to specify UID and GID, the user name is uneeded, so set --owner=0 --group=0

Currently, I observed a bug where the mtime of directories was set to the current time, breaking reproduciblity, so set --mtime as per recommendation. Note that SOURCE_DATE_EPOCH does need to be set for this to work. @ means the time will be intepreted as Unix Epoch.

Delete atime and ctime completely. No idea if this is better or worse.

Note: I'm not the original author, but the patch fixes the mtime issues I'm seeing on Arch. For example https://reproducible.archlinux.org/api/v0/builds/225293/diffoscope

Patch originally from https://bugs.kde.org/show_bug.cgi?id=443532 BUG: 443532

/cc @apol as per your request earlier, hope this MR helps move this forward Would be amazing if it can be backported to the stable branches.

Edited Jan 31, 2022 by Aleix Pol Gonzalez

Make template tar.bz2's reproducible.

Merge request reports