GNU bug report logs - #79170
Please make amhello-1.0.tar.gz reproducible

Previous Next

To reply to this bug, email your comments to 79170 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Jelle van der Waa <jelle <at> vdwaa.nl>
To: bug-automake <at> gnu.org
Subject: Please make amhello-1.0.tar.gz reproducible
Date: Mon, 4 Aug 2025 17:15:42 +0200

In Arch Linux our automake package includes 
/usr/share/doc/automake/amhello-1.0.tar.gz. When we rebuild this package 
using our rebuilder to check for reproduciblity the uid/gid and 
timestamps are not normalized meaning they vary per rebuild making the 
package non-reproducible. [1] [2]

The owner/guid could be set --owner=root:0 --group=root:0
 and to get rid of the timestamp --mtime='@0' (Or alternatively a fixed 
timestamp which can be set via SOURCE_DATE_EPOCH).

Alternatively the timestamp could be excluded by hardcoding the tar 
format to ustar which omits timestamps.

[1] https://reproducible.archlinux.org
[2] https://reproducible-builds.org/

Message #8 received at 79170 <at> debbugs.gnu.org (full text, mbox):

From: Karl Berry <karl <at> freefriends.org>
To: jelle <at> vdwaa.nl
Cc: 79170 <at> debbugs.gnu.org
Subject: Re: bug#79170: Please make amhello-1.0.tar.gz reproducible
Date: Tue, 5 Aug 2025 16:14:23 -0600

Hi Jelle - thanks for the report.

    The owner/guid could be set --owner=root:0 --group=root:0

OK.

      and to get rid of the timestamp --mtime='@0' (Or alternatively a fixed 
    timestamp which can be set via SOURCE_DATE_EPOCH).

Do you have a specific suggestion for how to use SOURCE_DATE_EPOCH here?
I don't want to fake the time when all the files were created to 1970 or
anything else. Having real mtimes seems useful.

    Alternatively the timestamp could be excluded by hardcoding the tar 
    format to ustar which omits timestamps.

1) What timestamp does ustar omit? AFAIK, every tar format stores mtimes
(and it's a good thing that they do).

2) In the latest automake release, I believe amhello already is ustar,
because we changed automake's default to be that in 1.18.
   
$ zcat /.../latest/.../gnu/share/doc/automake/amhello-1.0.tar.gz | file -
/dev/stdin: POSIX tar archive

Thanks,
Karl

Message #11 received at 79170 <at> debbugs.gnu.org (full text, mbox):

From: kpcyrd <kpcyrd <at> archlinux.org>
To: 79170 <at> debbugs.gnu.org
Subject: Re: bug#79170: Please make amhello-1.0.tar.gz reproducible
Date: Sat, 29 Nov 2025 20:38:32 +0100

hi!

> Do you have a specific suggestion for how to use SOURCE_DATE_EPOCH
> here? I don't want to fake the time when all the files were created to
> 1970 or anything else. Having real mtimes seems useful.

You don't need to worry about the value, this variable is meant to be 
set externally. From the reproducible-builds.org documentation, this is 
suggested for shell scripts on GNU systems:

BUILD_DATE="$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" 
+%Y-%m-%d)"

(You can of course tweak this to your needs, the important part is 
`--utc` and the construct for `--date="..."`)

https://reproducible-builds.org/docs/source-date-epoch/

From your build script's point of view, if $SOURCE_DATE_EPOCH is not 
set, you may use the current time.

If it is set, it is supposed to contain a unix timestamp you can use.

How this value is derived is specific to the individual (Linux) 
distributions, for example the Debian build system parses the datetime 
out of the latest `debian/changelog` entry, Arch Linux picks the current 
time at the start of the "official" build and documents this in build 
metadata (that is parsed and used when attempting to reproduce the package).

Let me know if you have further questions. :)

Happy to help,
kpcyrd

Message #14 received at 79170 <at> debbugs.gnu.org (full text, mbox):

From: Karl Berry <karl <at> freefriends.org>
To: kpcyrd <at> archlinux.org
Cc: 79170 <at> debbugs.gnu.org
Subject: Re: bug#79170: Please make amhello-1.0.tar.gz reproducible
Date: Tue, 2 Dec 2025 15:55:43 -0700

Thanks for the reply, but I can see I wasn't clear in my question.

    You don't need to worry about the value, this variable is meant to be 
    set externally. 

Right, I understand.

    BUILD_DATE="$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" 
    +%Y-%m-%d)"

1) Automake cannot assume GNU date, so those options cannot be used, but
I realize that's just an example.

2) More fundamentally, as things stand nothing makes use of
the variable.

    Let me know if you have further questions.

Can you propose an actual patch for doc/amhello?

I feel like the implication is for Automake to use SOURCE_DATE_EPOCH
everywhere, which sounds like quite an invasively large change. I admit
I can't really wrap my mind around it.

Meanwhile, from your original post it sounds like you already solved
the practical problems, so maybe we can just let this go? --thanks, karl.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.