[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug-gettext] [bug #49654] xgettext and build determinism

From: John Darrington
Subject: [bug-gettext] [bug #49654] xgettext and build determinism
Date: Sun, 20 Nov 2016 06:54:46 +0000 (UTC)
User-agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0


                 Summary: xgettext and build determinism
                 Project: GNU gettext
            Submitted by: jmd
            Submitted on: Sun 20 Nov 2016 07:54:44 AM CET
                Category: None
                Severity: 3 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any



Xgettext puts a line the generated .pot file of the form:
"POT-Creation-Date: 2016-11-20 07:47+0100\n"
which then gets propagated to all .po and .mo files.

This is problematic because it means that each time one builds a
project which uses xgettext one gets a different result, which raises concerns
about verifibility and security.

Some currently affected projects are listed at

Can I suggest that you either :

* Make the inclusion of this field an opt in flag to xgettext; OR
* Use the suggested standard at
https://reproducible-builds.org/specs/source-date-epoch/ which will set this
field to a canonical value.



Reply to this item at:


  Message sent via/by Savannah

reply via email to

[Prev in Thread] Current Thread [Next in Thread]