FS#67737 - [gnupg] make use of --enable-build-timestamp for reproducibility.

Attached to Project: Arch Linux
Opened by Hussam Al-Tayeb (hussam) - Thursday, 27 August 2020, 15:30 GMT
Last edited by freswa (frederik) - Thursday, 27 August 2020, 23:19 GMT
Task Type Bug Report
Category Packages: Core
Status Closed
Assigned To No-one
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

make use of --enable-build-timestamp for reproducible builds.

the configure options says:
--enable-build-timestamp
set an explicit build timestamp for reproducibility.
This task depends upon

Closed by  freswa (frederik)
Thursday, 27 August 2020, 23:19 GMT
Reason for closing:  Not a bug
Additional comments about closing:  Not embedding timestamps is already the default (see e.g. the commit message of https://github.com/gpg/gnupg/commit/9d07 f6930aaa40dce92104e8c99241713d92eed2)
Comment by Jonas Witschel (diabonas) - Thursday, 27 August 2020, 16:13 GMT
That shouldn't be necessary, if this option isn't given, the build timestamp is replaced by "<none>", which is reproducible as well. [1] Besides, the build timestamp appears to be used only in the Windows build anyway, the only occurrence I could find in the repository is in common/w32info-rc.h.in [2].

In fact, the Arch Linux package gnupg 2.2.21-1 can already be successfully reproduced [3]:

{
"name": "gnupg",
"version": "2.2.21-1",
"status": "GOOD",
"distro": "archlinux",
"suite": "core",
"architecture": "x86_64",
"url": "https://mirror.pkgbuild.com/core/os/x86_64/gnupg-2.2.21-1-x86_64.pkg.tar.zst"
}

[1] https://github.com/gpg/gnupg/blob/af189be481df02a77e088aa0a60a1fc02dfa12bf/configure.ac#L1926-L1927
[2] https://github.com/gpg/gnupg/blob/592deeddb9bf4ae9b3e236b439e2f39644eb6d46/common/w32info-rc.h.in#L26
[3] https://reproducible.archlinux.org/api/v0/pkgs/list

Loading...