Re: RFC: Sort tarballs created by the src-release.sh script

Jan Beulich via Gdb-patches
2022-10-03T06:57:39Z

On 02.10.2022 09:54, Sam James wrote:
>
>
>> On 30 Sep 2022, at 12:38, Nick Clifton via Binutils <binutils@sourceware.org> wrote:
>>
>> ﻿Hi Guys,
>>
>> Right, here is the latest and greatest - and hopefully last - version
>> of the patch. I added a parseable string to the --mtime option and a
>> comment explaining why these options are being used.
>>
>> Any more comments/suggestions ?
>>
>> Cheers
>> Nick
>>
>> diff --git a/src-release.sh b/src-release.sh
>> index 079b545ae7c..8a2ac125030 100755
>> --- a/src-release.sh
>> +++ b/src-release.sh
>> @@ -184,9 +184,11 @@ do_tar()
>> ver=$2
>> echo "==> Making $package-$ver.tar"
>> rm -f $package-$ver.tar
>> + # The sort command and --mtime, --group and --owner options are
>> + # used in order to create consistent, reproducible tarballs.
>> find $package-$ver -follow \( $CVS_NAMES \) -prune \
>> - -o -type f -print \
>> - | tar cTfh - $package-$ver.tar
>> + -o -type f -print | LC_ALL=C sort \
>> + | tar cTfh - $package-$ver.tar --mtime="1970-01-01 00:00:00" --group=0 --owner=0
>> }
>>
>> # Compress the output with bzip2
>>
>
> I think this might hit a problem I faced when trying to do this with Go tarballs: https://www.gnu.org/software/tar/manual/tar.html#warnings.
>
> With that date, I got "implausibly old time stamp" warnings from tar. I haven't tested this patchthough (writing from mobile, apologies).
>
> Maybe default to the creation date of Binutils and allow overriding via https://reproducible-builds.org/docs/source-date-epoch/?

Not sure what "creation date" might mean here. Assuming the script is
(typically) run from a git tree, perhaps the commit date of the top
level commit on the branch would be best to use?

Jan