Re: RFC: Sort tarballs created by the src-release.sh script

Andreas Schwab via Gdb-patches
2022-10-03T19:56:52Z

On Okt 03 2022, Nick Clifton wrote:

> We could use the src-release.sh file itself, like this:

The timestamp of checked out files has no meaning, and is generally not
reproducible.

> diff --git a/src-release.sh b/src-release.sh
> index 079b545ae7c..de1f98a70bb 100755
> --- a/src-release.sh
> +++ b/src-release.sh
> @@ -184,9 +184,15 @@ do_tar()
> ver=$2
> echo "==> Making $package-$ver.tar"
> rm -f $package-$ver.tar
> + # The sort command and --mtime, --group and --owner options are
> + # used in order to create consistent, reproducible tarballs.
> + # BUILD_DATE is set to SOURCE_DATE_EPOCH if defined, or the
> + # modification date of this file otherwise. cf:
> + # https://reproducible-builds.org/docs/source-date-epoch/
> + BUILD_DATE="$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date -r src-release.sh +%s)}" +%Y-%m-%d)"
> find $package-$ver -follow \( $CVS_NAMES \) -prune \
> - -o -type f -print \
> - | tar cTfh - $package-$ver.tar
> + -o -type f -print | LC_ALL=C sort \
> + | tar cTfh - $package-$ver.tar --mtime=$BUILD_DATE --group=0 --owner=0

That won't work, as --mtime=$BUILD_DATE is interpreted in the local time zone.

--
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."