[Bug-tar] Difference between -z option and piping to gzip

[Jim Hefferon]

Hello,

I'm the maintainer of the US site of CTAN, the TeX archive.  We are having
a difficulty with tar.  (I am running a tar that reports itself as version
1.13, which is what the GNU archive that I checked says is the latest version.)

The difficulty is that there is a difference between using the -z option
and piping to gzip.  I've got a transcript of a session that illustrates
the effect below.

It causes us trouble for the following reason:  we allow users to get
an entire directory at once with on-the-fly tar-ring (as you no doubt
know all about).  A BSD maintainer contacted us with the information that
they cannot include a package that we store because every time they
get it (as a .tar.gz) it has a different MD5, and they require that
a fixed MD5 be there so users can check for a secure download.

We understand that the -z option is storing some information (we percieve
that it is the time of last access) that is not stored by piping to 
gzip.  Obviously that would account for the constantly changing MD5.

This is a difficulty.  I do not want to spawn a shell to pipe output
from tar through gzip every time a user requests an archive, both for
performance reasons and because I am nervous about the security implications
of bringing a shell into the process.  

Is it possible to make the -z option yield the same outcome as piping through
gzip?  I guess that in short the current behavior appears to me to be in
conflict with the description from the manual:     

     This option tells `tar' to read or write archives through `gzip',
     allowing `tar' to directly operate on several kinds of compressed
     archives transparently.  .

Thanks,
Jim Hefferon


Here, if I tar -z the same file twice, with a delay of more than a
minute, and then od the two files then diff finds a difference.
But piping them through gzip gets to an od that shows no difference.

------ transcript (extraneous material edited) --------------

address@hidden temp]$ tar --version
tar (GNU tar) 1.13

Copyright (C) 1988, 92,93,94,95,96,97,98, 1999 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Written by John Gilmore and Jay Fenlason.
address@hidden temp]$ ls -l
total 4
drwxrwxr-x   10 ftpmaint ftpmaint     4096 Jul  8  1999 tar-1.13
address@hidden temp]$ rm -Rf tar-1.13
address@hidden temp]$ ls -l
total 0
address@hidden temp]$ echo "this is a test" > testfile
address@hidden temp]$ tar -czvf test1.tgz testfile
testfile
address@hidden temp]$ sleep 90
address@hidden temp]$ tar -czvf test2.tgz testfile
testfile
address@hidden temp]$ ls -l
total 12
-rw-rw-r--    1 ftpmaint ftpmaint      139 Jan  2 15:19 test1.tgz
-rw-rw-r--    1 ftpmaint ftpmaint      139 Jan  2 15:21 test2.tgz
-rw-rw-r--    1 ftpmaint ftpmaint       15 Jan  2 15:18 testfile
address@hidden temp]$ od test1.tgz > test1.od
address@hidden temp]$ od test2.tgz > test2.od
address@hidden temp]$ diff test1.od test2.od
1c1
< 0000000 105437 000010 105771 037765 001400 151355 005115 040302
---
> 0000000 105437 000010 106214 037765 001400 151355 005115 040302
address@hidden temp]$ gunzip test1.tgz
address@hidden temp]$ gunzip test2.tgz
address@hidden temp]$ od test1.tar > test1.od
address@hidden temp]$ od test2.tar > test2.od
address@hidden temp]$ diff test1.od test2.od
address@hidden temp]$ rm test1.tar test2.tar
address@hidden temp]$ tar -cvf - testfile | gzip -n >test1.tgz
testfile
address@hidden temp]$ sleep 90
address@hidden temp]$ tar -cvf - testfile | gzip -n >test2.tgz
testfile
address@hidden temp]$ ls -l
total 20
-rw-rw-r--    1 ftpmaint ftpmaint      912 Jan  2 15:25 test1.od
-rw-rw-r--    1 ftpmaint ftpmaint      139 Jan  2 15:26 test1.tgz
-rw-rw-r--    1 ftpmaint ftpmaint      912 Jan  2 15:25 test2.od
-rw-rw-r--    1 ftpmaint ftpmaint      139 Jan  2 15:32 test2.tgz
-rw-rw-r--    1 ftpmaint ftpmaint       15 Jan  2 15:18 testfile
address@hidden temp]$ od test1.tgz > test1.od
address@hidden temp]$ od test2.tgz > test2.od
address@hidden temp]$ diff test1.od test2.od