[Reproducible-builds] Variation in day

[Daniel Kahn Gillmor]

On Tue 2015-02-24 16:48:44 -0500, Jérémy Bobbio wrote:
> Reiner Herrmann:
>> after Faux found a package with a variation not in time, but only
>> in the date [1] because it was built around midnight, I had an idea
>> about how to get a variation in the day, without having to change
>> the clock of the host.
>> 
>> Varying the timezone between the first and second build to the
>> lowest and highest possible offset gives a difference of about
>> one day:
>> 
>> $ TZ=/usr/share/zoneinfo/Etc/GMT+12 date
>> Tue Feb 24 09:05:40 GMT+12 2015
>> $ TZ=/usr/share/zoneinfo/Etc/GMT-14 date
>> Wed Feb 25 11:05:49 GMT-14 2015
>> 
>> It is even possible to cover a day and 2 hours. :)
>> (Perhaps it's even possible to create custom timezones, that
>> would allow even larger variations like a year or so...?)
>> 
>> What do you think about this approach?
>> Would there be any disadvantages, and does anyone know
>> of tools that ignore the TZ setting?
>
> That would be the difference between gmtime(3) and localtime(3). So this
> will not catch tools using time in UTC format.
>
> But timezone is a worthwhile variation in itself! :)

Agreed.  This should be part of the varied environment during a rebuild,
even if it doesn't catch tools that use the UTC format.

     --dkg