Re: RFC: Sort tarballs created by the src-release.sh script

Sam James via Gdb-patches
2022-10-02T07:55:36Z

> On 30 Sep 2022, at 12:38, Nick Clifton via Binutils <binutils@sourceware.org> wrote:
>
> ﻿Hi Guys,
>
> Right, here is the latest and greatest - and hopefully last - version
> of the patch. I added a parseable string to the --mtime option and a
> comment explaining why these options are being used.
>
> Any more comments/suggestions ?
>
> Cheers
> Nick
>
> diff --git a/src-release.sh b/src-release.sh
> index 079b545ae7c..8a2ac125030 100755
> --- a/src-release.sh
> +++ b/src-release.sh
> @@ -184,9 +184,11 @@ do_tar()
> ver=$2
> echo "==> Making $package-$ver.tar"
> rm -f $package-$ver.tar
> + # The sort command and --mtime, --group and --owner options are
> + # used in order to create consistent, reproducible tarballs.
> find $package-$ver -follow \( $CVS_NAMES \) -prune \
> - -o -type f -print \
> - | tar cTfh - $package-$ver.tar
> + -o -type f -print | LC_ALL=C sort \
> + | tar cTfh - $package-$ver.tar --mtime="1970-01-01 00:00:00" --group=0 --owner=0
> }
>
> # Compress the output with bzip2
>

I think this might hit a problem I faced when trying to do this with Go tarballs: https://www.gnu.org/software/tar/manual/tar.html#warnings.

With that date, I got "implausibly old time stamp" warnings from tar. I haven't tested this patchthough (writing from mobile, apologies).

Maybe default to the creation date of Binutils and allow overriding via https://reproducible-builds.org/docs/source-date-epoch/?

best,
sam