Re: reproducible built files

[Bruno Haible]

Simon Josefsson wrote on 2024-12-12:
> +TAR_OPTIONS += --mode=go+u,go-w --mtime=$(abs_top_srcdir)/NEWS
> 
> and to Makefile.am:
> 
> +dist-hook: mtime-NEWS-to-git-HEAD
> +.PHONY: mtime-NEWS-to-git-HEAD
> +mtime-NEWS-to-git-HEAD:
> +     $(AM_V_GEN)if test -e $(srcdir)/.git \
> +                     && command -v git > /dev/null; then \
> +             touch -m -d @"$$(git log -1 --format=%ct)" $(srcdir)/NEWS; \
> +     fi
> 
> This is an ugly hack (for several reasons), but it has sustained some
> testing

I don't find this ugly at all. More than that, it generalizes to built files.

Assume that a tarball needs to contain a generated file Y, built from files
X1, X2, ..., Xn, and that the timestamp of Y is relevant (either embedded in Y
or as the mtime of Y). And we want that timestamp of Y to be reproducible,
that is, not blindly use the current time. Rather than assign a silly
EPOCH_DATE or some other nonsense [1], the idea would be to take

  timestamp(Y) := max (vmtime(X1), vmtime(X2), ..., vmtime(Xn)).

where vmtime(X) is defined as:

   - if X is under version control and not modified locally:
     $(git log -1 --format=%ct X),
     that is, the last time file X was modified under version control,
   - otherwise: mtime(X).

This has the properties that:
  - Different users who build the same git repo on different machines,
    at different times, get the same timestamp(Y).
  - If a user has modified one of the files X1,...,Xn locally, the
    modification time of that file counts.
  - If that user then reverts the modification, he then again gets the
    same timestamp(Y) as everyone else.
  - Different users who build the same tarball (without .git directory)
    on different machines, at different times, also get the same
    timestamp(Y) [but possibly a different one than when the .git directory
    was present]. (Assuming a POSIX compliant file system, i.e. not Haiku.)
  - When a user commits local modifications into git, this only increases
    (not decreases) the timestamp(Y).

I'm considering to use this approach in xgettext, with {X1,...,Xn} being
{po/POTFILES.in, all source files listed in po/POTFILES).

But it would also work for generated man pages or other documentation.

Anything that I might have overlooked?

Bruno

[1] https://reproducible-builds.org/docs/timestamps/