[Reproducible-builds] Bug#762397: libgpg-error: please do not capture the current time during the build process

[Jeroen Dekkers]

(Removed the bug from the CC as this is a more general discussion)

At Mon, 22 Sep 2014 22:57:55 +0200,
Jérémy Bobbio wrote:
> But, sincerely, I believe the right move for upstream would be to get
> rid of the embedded timestamp entirely. Embedding a Git commit id would
> make much more sense (and mabye its date) than embedding the time of the
> build.

I agree, but I am not so sure that we can convince every upstream
about this, whether we should spend our time arguing about it and
whether we should start creating more complicated patches that for
example embed a git commit (if that's at all possible - how do you get
the git commit when building from a tarball?) instead of creating a
simpler patch that makes the timestamp reproducible.

> PPS: If we start bikeshedding on every patch, there's not even the
> slightest chance we will get to the point where build reproducibility is
> actually a Debian feature. We need to trust maintainers to do the right
> things.

I definitely don't want to bikeshed about every patch, but I think
it's a good idea to discuss what is the best way to fix this class of
bugs, because we are going to have to fix this in a lot more places. I
remember from the DC13 bof that it was proposed to have
dpkg-buildpackage export the locale, so my thought was, instead of
having to do this in the debian/rules of every package that needs it,
why not have dpkg-buildpackage export the changelog timestamp?

And even if we put it in debian/rules, I think it's a good idea to
standardize on the environment name we use for this.


Kind regards,

Jeroen Dekkers