[pkg-go] Minutes for the DebConf17 BoF

Martín Ferrari tincho at tincho.org
Thu Nov 9 00:01:45 UTC 2017

On 08/11/17 17:55, Michael Stapelberg wrote:

> Quote from the commit message
> (https://anonscm.debian.org/git/pkg-go/website.git/commit/?id=866810cfeea8086dbdfc0176b148f7a063e3ac0b):
One comment on this:

+NOTE: Using `--git-upstream-tree=TAG` (the default) is not sufficient
to obtain
+a byte-for-byte equal orig .tar.gz file. In stapelberg’s tests, only 5% of
+pkg-go’s git repositories would match the orig .tar.gz in the archive.

I think this test is not useful, because probably that 95% of packages
matches those whose tars were not created by gbp, but by upstream or by

If you are using gbp, the tars are meant to be reproducible, but not
necesarily equal to pristine-tar. I think it uses last commit time to
set the mtime of each file, and that could surely be different in a
tarball created by upstream.

The best test would be to use gbp to create the tarballs under different
conditions (machine, user name, path, manually touch()ing files locally)
and see if they are really reproducible.

Martín Ferrari (Tincho)

More information about the Pkg-go-maintainers mailing list