[Android-tools-devel] src:repo Should Use git-import-orig Rather Than Merging Upstream

[Hans-Christoph Steiner]

If you wanted to try to make a reproducible repack now, I got halfway there:

First fetch the timestamp from the git commit:

curl
https://android.googlesource.com/platform/external/libselinux/+log/android-6.0.0_r26
\
 | sed 's,\n *,,g' \
 | sed -n 's,.*<tr><th
class="Metadata-title">tagger</th>.*<td>\([A-Z][^<]*\)</td>.*,\1,p'

Then modify mk-origtargz to accept --mtime:
https://stackoverflow.com/a/16728218

I filed a bug report to request this:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807270

.hc

Hans-Christoph Steiner:
> 
> I think that approach is nice and simple.  I'm fine with switching to it
> for all of the android-tools packages with a minor change: stick with
> the upstream tarball format, e.g. .tar.gz, to keep it simple.  I'm
> working on getting googlesource.com to make reproducible tarballs, so
> that every time someone downloads the tarball, it'll be exactly the same.
> 
> Currently, I think the only differences are the timestamps, so this
> should be easy to achieve.
> 
> .hc
> 
> 殷啟聰:
>> Hi Hans,
>>
>> When I was about to package a newer version of repo, I found the
>> package on Alioth directly merges upstream in order to to fetch
>> source. Since Gitlies is able to download a tagged tree as a tarball,
>> src:repo should simply use git-import-orig to import source. This
>> approach is simpler and won't pull upstream Git logs into Alioth.
>>
>> Take a look at the get-orig-source rule in debian/rules of my AOSP
>> packages, for example
>> <http://anonscm.debian.org/cgit/android-tools/android-platform-external-libselinux.git/tree/debian/rules>.
>>
>> Regards,
>> Kai-Chung Yan
>>