[Reproducible-builds] Bug#790415: tar: please add --clamp-mtime to only update mtimes after a given time

[Jérémy Bobbio]

Package: tar
Version: 1.27.1-2
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: toolchain timestamps

Hi!

Within the “reproducible builds” effort [1], we are always trying to
find better solutions to make it either to create determenistic build
systems.

One issue we face regularly (and `dpkg` is actually affected) is
that timestamps of files created during the build gets embedded in
tarballs. This makes them impossible to reproduce at another time.

Our generic solution [2] is to use a reference time (e.g. the time of the
latest entry in `debian/changelog') and use it for all files created
later instead of their actual modification date.

We currently implement this by a long call to find+xargs+touch before
calling tar. On top of the extra complexity, this has downside of
modifying the filesystem when we actually only care about the archive
content.

The attached patch adds a `--clamp-mtime` option to tar. When specified
together with `--mtime`, it will switch to the aforementioned behavior
instead of setting all mtimes to the same value.

Sadly, after being submitted upstream [3], Paul Eggert failed to see the
benefits of this addition. Help in moving the matter further, in Debian
or upstream, would be most welcome.

 [1]: https://wiki.debian.org/ReproducibleBuilds
 [2]: https://wiki.debian.org/ReproducibleBuilds/TimestampsInTarball
 [3]: https://lists.gnu.org/archive/html/help-tar/2015-06/msg00000.html

Thanks,
-- 
Lunar                                .''`. 
lunar at debian.org                    : :Ⓐ  :  # apt-get install anarchism
                                    `. `'` 
                                      `-   
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-add-a-clamp-mtime-option-to-make-reproducible-builds.patch
Type: text/x-diff
Size: 8077 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20150629/c8765129/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20150629/c8765129/attachment.sig>