5 ms·
I don't really understand what in this feature makes the build non-reproducible. Judging by the patch it's the call to time(NULL) that seems to be problematic,
by simias 10y ago
I don't really understand what in this feature makes the build non-reproducible. Judging by the patch it's the call to time(NULL) that seems to be problematic, but I don't understand why.
- lamby 10y agoIt doesn't; it makes anyone using the output...
- smcl 10y agoYeh I only skimmed the patch but I presumed "reproducable build" referred to the actual binary, and the patch addresses runtime behaviour. Guess I'm missing something.
- karrotwaltz 10y agoFrom what I can read in patch file, it seems to be doing something different on April fools day.
- kr7 10y agoThe output of "apt-get moo" changes on special days (4/1, 12/25, 8/16, 11/7, 2/18). So if another program was using "apt-get moo" in its build script, the build would not be reproducible. With the patch, the SOURCE_DATE_EPOCH environment variable can be set to make "apt-get moo" deterministic. I don't think anything actually uses "apt-get moo" in its build script. This kind of patch makes more sense for build tools like "ar" (static library creator). By default, "ar" injects a timestamp into the output file, so the binary is different each build. But, use the "D" flag and "ar" becomes deterministic.
- rzzzt 10y agoThe time-dependent part can be seen here: https://github.com/Debian/apt/blob/master/apt-private/private-moo.cc#L164 https://github.com/Debian/apt/blob/master/apt-private/privat...
- kr7 10y agoThere is a second part above too: https://github.com/Debian/apt/blob/master/apt-private/private-moo.cc#L33 https://github.com/Debian/apt/blob/master/apt-private/privat...