[pacman-dev] [PATCH] makepkg: respect $SOURCE_DATE_EPOCH to activate reproducible builds

[Levente Polyak]

On 07/28/2017 04:36 AM, Allan McRae wrote:
> On 07/07/17 03:26, Eli Schwartz wrote:
>> If SOURCE_DATE_EPOCH is set, `touch` all source files before running
>> build() to fix the modification times. This works around build systems
>> and compilers that embed the file modification times into the file
>> contents of release artifacts.
>>
> 
> I think this is a reasonable compromise.
> 
> @Levente:  are you happy with this approach?
> 


The conditional REPRODUCIBLE touch block should be outside of run_build
as former would imply that a build() function is mandatory inside every
PKGBUILD to make this work.
Its quite common (f.e. for python) to not have a build() function and I
believe it should generally work without enforcing to have such function.
Therefor I would recommend we move that block between run_build and
run_prepare, f.e. a place where this works is line 1696 in commit bcc9c417.
A tested/verified adjustment doing the above would be:
https://github.com/anthraxx/pacman/commit/520acf93d83774c4b74ec8c19c1ba31fddbdb8da


Technically this approach will work, but personally i believe this is a
bit too much hidden requirement to make it work. So for clarity I would
either recommend we add a section describing this behaviour inside the
manpage (as manually defining SOURCE_DATE_EPOCH will be mandatory to
make it work) or we use makepkg flags plus config (which will also make
it more transparent).
I don't have any strong favorites, Eli implementation will do its job,
the only difference will be that manually setting SOURCE_DATE_EPOCH is
mandatory for the first initial invocation as well.

cheers,
Levente

PS: thanks :P

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/pacman-dev/attachments/20170728/97e0fd47/attachment.asc>