Re: RFC: Sort tarballs created by the src-release.sh script

Nick Clifton via Gdb-patches
2022-10-03T14:40:32Z

Hi Guys,

[This appears to be getting slightly out of hand...]

> Not sure what "creation date" might mean here. Assuming the script is > (typically) run from a git tree, perhaps the commit date of the top> level commit on the branch would be best to use?
Except that a commit to the branch that does not affect something that
would go into the tarball would then result in a changed date.

We could use the src-release.sh file itself, like this:

diff --git a/src-release.sh b/src-release.sh
index 079b545ae7c..de1f98a70bb 100755
--- a/src-release.sh
+++ b/src-release.sh
@@ -184,9 +184,15 @@ do_tar()
ver=$2
echo "==> Making $package-$ver.tar"
rm -f $package-$ver.tar
+ # The sort command and --mtime, --group and --owner options are
+ # used in order to create consistent, reproducible tarballs.
+ # BUILD_DATE is set to SOURCE_DATE_EPOCH if defined, or the
+ # modification date of this file otherwise. cf:
+ # https://reproducible-builds.org/docs/source-date-epoch/
+ BUILD_DATE="$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date -r src-release.sh +%s)}" +%Y-%m-%d)"
find $package-$ver -follow \( $CVS_NAMES \) -prune \
- -o -type f -print \
- | tar cTfh - $package-$ver.tar
+ -o -type f -print | LC_ALL=C sort \
+ | tar cTfh - $package-$ver.tar --mtime=$BUILD_DATE --group=0 --owner=0
}

# Compress the output with bzip2

Would that work ?

Cheers
Nick