[pkg-go] Minutes for the DebConf17 BoF

[Martín Ferrari]

On 08/11/17 17:55, Michael Stapelberg wrote:

> Quote from the commit message
> (https://anonscm.debian.org/git/pkg-go/website.git/commit/?id=866810cfeea8086dbdfc0176b148f7a063e3ac0b):
One comment on this:

+NOTE: Using `--git-upstream-tree=TAG` (the default) is not sufficient
to obtain
+a byte-for-byte equal orig .tar.gz file. In stapelberg’s tests, only 5% of
+pkg-go’s git repositories would match the orig .tar.gz in the archive.

I think this test is not useful, because probably that 95% of packages
matches those whose tars were not created by gbp, but by upstream or by
pristine-tar.

If you are using gbp, the tars are meant to be reproducible, but not
necesarily equal to pristine-tar. I think it uses last commit time to
set the mtime of each file, and that could surely be different in a
tarball created by upstream.

The best test would be to use gbp to create the tarballs under different
conditions (machine, user name, path, manually touch()ing files locally)
and see if they are really reproducible.

-- 
Martín Ferrari (Tincho)