Re: reproducible tar archives

[Janneke Nieuwenhuizen]

Simon Josefsson via Gnulib discussion list writes:

> We have code to make release tar archives reproducible:

Nice!

We finally had an effort this year to make the Guix source tarball reproducible

--8<---------------cut here---------------start------------->8---
ba52975ea9 Revert "maint: Generate 'doc/version.texi' reproducibly."
2a622090fa Revert "maint: Generate 'doc/version-LANG.texi' reproducibly."
416f11f1d4 maint: Ensure generated file reproducibility for dist.
4099b12f9f maint: Avoid EPS generation to fail silently, ensure reproducibility.
ecf0e22dcf maint: Use reproducible Git timestamp for POT-Creation-Date.
6c63c36677 maint: Use xgettext.scm wrapper to create .PO files reproducibly.
b4d2838d51 maint: Generate 'doc/version-LANG.texi' reproducibly.
b850d77e11 maint: Generate AUTHORS and ChangeLog reproducibly.
ea23a124ad maint: Help help2man generate reproducible man-pages.
8fdc372841 maint: Generate 'doc/version.texi' reproducibly.
b0c33b1997 maint: Use reproducible timestamps and name for tarball.
--8<---------------cut here---------------end--------------->8---

but for Guix it's was more effort than for smaller packages...

> https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=blob;f=top/GNUmakefile;hb=5b92dd0a45c8d27f13a21076b57095ea5e220870#l28

Guix is using 
https://git.savannah.gnu.org/cgit/guix.git/tree/Makefile.am?id=b0c33b1997e4a02e048ceac445b156b3a1eed76d#n1006

--8<---------------cut here---------------start------------->8---
# Reproducible tarball
override GZIP_ENV = --best --no-name
# Be friendly to Debian; avoid using EPOCH
override am__tar = $${TAR-tar}                  \
 --format=ustar                                 \
 --sort=name                                    \
 --mode=go=rX,u+rw,a-s                          \
 --mtime=@$$(cat "$$tardir"/.tarball-timestamp) \
 --owner=0 --group=0 --numeric-owner            \
 -cf -                                          \
 "$$tardir"
--8<---------------cut here---------------end--------------->8---

with

--8<---------------cut here---------------start------------->8---
gen-tarball-version:
        echo $(VERSION) > "$(distdir)/.tarball-version"
        echo $(SOURCE_DATE_EPOCH) > $(distdir)/.tarball-timestamp
--8<---------------cut here---------------end--------------->8---

and

--8<---------------cut here---------------start------------->8---
HELP2MANFLAGS = --source=GNU --info-page=$(PACKAGE_TARNAME)
# help2man reproducibility
SOURCE_DATE_EPOCH = $(shell git show HEAD --format=%ct --no-patch 2>/dev/null 
|| echo 1)
export SOURCE_DATE_EPOCH
--8<---------------cut here---------------end--------------->8---

To get po to generate reproducible required hacking an xgettext script.

https://git.savannah.gnu.org/cgit/guix.git/tree/build-aux/xgettext.scm?id=6c63c366776643e5831c50a2b7e29bad93273327

Greetings,
Janneke

-- 
Janneke Nieuwenhuizen <janneke@gnu.org>  | GNU LilyPond https://LilyPond.org
Freelance IT https://www.JoyOfSource.com | Avatar® https://AvatarAcademy.com