GNU bug report logs - #38162
icedtea "jar" tool could automatically pack reproducible jars

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guix; Reported by: Danny Milosavljevic <dannym@HIDDEN>; dated Sun, 10 Nov 2019 14:49:02 UTC; Maintainer for guix is bug-guix@HIDDEN.

Message received at 38162 <at> debbugs.gnu.org:


Received: (at 38162) by debbugs.gnu.org; 11 Nov 2019 20:59:23 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Nov 11 15:59:23 2019
Received: from localhost ([127.0.0.1]:56054 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1iUGmR-0002to-1U
	for submit <at> debbugs.gnu.org; Mon, 11 Nov 2019 15:59:23 -0500
Received: from eggs.gnu.org ([209.51.188.92]:44285)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@HIDDEN>) id 1iUGmP-0002ta-7H
 for 38162 <at> debbugs.gnu.org; Mon, 11 Nov 2019 15:59:21 -0500
Received: from fencepost.gnu.org ([2001:470:142:3::e]:50152)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <ludo@HIDDEN>)
 id 1iUGmJ-0000yx-PZ; Mon, 11 Nov 2019 15:59:15 -0500
Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=42536 helo=ribbon)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256)
 (Exim 4.82) (envelope-from <ludo@HIDDEN>)
 id 1iUGmI-0005uW-PH; Mon, 11 Nov 2019 15:59:15 -0500
From: =?utf-8?Q?Ludovic_Court=C3=A8s?= <ludo@HIDDEN>
To: Danny Milosavljevic <dannym@HIDDEN>
Subject: Re: bug#38162: icedtea "jar" tool could automatically pack
 reproducible jars
References: <20191110154849.1123db10@HIDDEN>
Date: Mon, 11 Nov 2019 21:59:13 +0100
In-Reply-To: <20191110154849.1123db10@HIDDEN> (Danny Milosavljevic's
 message of "Sun, 10 Nov 2019 15:48:49 +0100")
Message-ID: <87pnhym8ny.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Spam-Score: -2.3 (--)
X-Debbugs-Envelope-To: 38162
Cc: 38162 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -3.3 (---)

Hi Danny,

Danny Milosavljevic <dannym@HIDDEN> skribis:

> it would be better if icedtea's "jar" tool automatically packed reproduci=
ble jar
> files instead of us doing some barely safe unzip-then-rezip-with-specific=
-order
> in the ant-build-system.
>
> It could check the environment variable SOURCE_DATE_EPOCH and then use th=
at as
> timestamp for the zip entries.

Someone proposed patches several months ago to reset timestamps in
jar/zip files, which I reviewed, but then lost track of (which may well
be my fault!) and I can=E2=80=99t find them on guix-patches now.

If you don=E2=80=99t mind researching a bit :-), this could be helpful.

Ludo=E2=80=99.




Information forwarded to bug-guix@HIDDEN:
bug#38162; Package guix. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 10 Nov 2019 14:48:59 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Nov 10 09:48:59 2019
Received: from localhost ([127.0.0.1]:50810 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1iToWR-0001Jp-By
	for submit <at> debbugs.gnu.org; Sun, 10 Nov 2019 09:48:59 -0500
Received: from lists.gnu.org ([209.51.188.17]:33519)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <dannym@HIDDEN>) id 1iToWP-0001Jf-4b
 for submit <at> debbugs.gnu.org; Sun, 10 Nov 2019 09:48:58 -0500
Received: from eggs.gnu.org ([2001:470:142:3::10]:43594)
 by lists.gnu.org with esmtp (Exim 4.90_1)
 (envelope-from <dannym@HIDDEN>) id 1iToWN-0004bj-Jf
 for bug-guix@HIDDEN; Sun, 10 Nov 2019 09:48:56 -0500
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-0.7 required=5.0 tests=BAYES_40,RCVD_IN_DNSWL_LOW
 autolearn=disabled version=3.3.2
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <dannym@HIDDEN>) id 1iToWJ-0001bo-VC
 for bug-guix@HIDDEN; Sun, 10 Nov 2019 09:48:54 -0500
Received: from dd26836.kasserver.com ([85.13.145.193]:56358)
 by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
 (Exim 4.71) (envelope-from <dannym@HIDDEN>)
 id 1iToWJ-0001aa-Oi
 for bug-guix@HIDDEN; Sun, 10 Nov 2019 09:48:51 -0500
Received: from localhost (unknown [185.17.13.127])
 by dd26836.kasserver.com (Postfix) with ESMTPSA id 568C33360AA1
 for <bug-guix@HIDDEN>; Sun, 10 Nov 2019 15:48:50 +0100 (CET)
Date: Sun, 10 Nov 2019 15:48:49 +0100
From: Danny Milosavljevic <dannym@HIDDEN>
To: <bug-guix@HIDDEN>
Subject: icedtea "jar" tool could automatically pack reproducible jars
Message-ID: <20191110154849.1123db10@HIDDEN>
X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; x86_64-unknown-linux-gnu)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="Sig_/AfOnfzRXLSLemFYdHblEL6e";
 protocol="application/pgp-signature"; micalg=pgp-sha256
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
 [fuzzy]
X-Received-From: 85.13.145.193
X-Spam-Score: -2.3 (--)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -3.3 (---)

--Sig_/AfOnfzRXLSLemFYdHblEL6e
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

Hi,

it would be better if icedtea's "jar" tool automatically packed reproducibl=
e jar
files instead of us doing some barely safe unzip-then-rezip-with-specific-o=
rder
in the ant-build-system.

It could check the environment variable SOURCE_DATE_EPOCH and then use that=
 as
timestamp for the zip entries.

Alternatively, it could just leave the DOS timestamp field off of the zip
entries.

Maven already has support for the former[1]--we might be able to reuse that.

[1] https://maven.apache.org/plugins/maven-jar-plugin/jar-mojo.html

--Sig_/AfOnfzRXLSLemFYdHblEL6e
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEds7GsXJ0tGXALbPZ5xo1VCwwuqUFAl3II1EACgkQ5xo1VCww
uqXvhAf8CasRnJCxUqlNONVPeF/HMATV9YVzEpLjNkaTnoP8HlOEaM+LPWaLXt87
lSbA5yFLGZRPPTz9xPUutM8vWg/XyAl5O/jGIDPDK29Vl2hlUwxrFyo3WmTP0QBs
lPj9n48Z5ZwM4NoLS6KAPNCokwPR/wVOs1m5OhfrzCDGrOIVAnksNE39MZxEfIZR
54UFQOlInzCSgnBpMiDuO7UEnV4xRiXeSp/dHZ/aK3KAQKLJeKHMRLOkKao+ePtQ
KOaHPHcydyVh75SnDcBnLV9psmOKH+SIfc0ydSkEPKD6yUdZirpR+PlRH2UFX9Gw
iftF/EkLVucN48jx5FGZnAuBwn19vA==
=kGaR
-----END PGP SIGNATURE-----

--Sig_/AfOnfzRXLSLemFYdHblEL6e--




Acknowledgement sent to Danny Milosavljevic <dannym@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-guix@HIDDEN. Full text available.
Report forwarded to bug-guix@HIDDEN:
bug#38162; Package guix. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Mon, 25 Nov 2019 12:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.