[buildd-tools-devel] Bug#843773: Bug#843773: misleading timestamps in binnmus

[Ximin Luo]

Ansgar Burchardt wrote:
> The date from the last sourceful upload should probably still be used
> for any date/time information included in generated files to ensure
> they are identical on all architectures (or at least to try to do so).
> 
> If you change the date in the binNMU entry, SOURCE_DATE_EPOCH should
> probably be set to the date of the last sourceful upload (instead of
> just using the most recent changelog entry).
> 

Holger Levsen wrote:
> On Thu, Nov 10, 2016 at 08:59:48AM -0200, Johannes Schauer wrote:
> > One solution would be to increase SOURCE_DATE_EPOCH by 1 second for every
> > binNMU to a package.
> > 
> > Any other ideas?
> 
> set SOURCE_DATE_EPOCH to the creation time of that changelog.$arch
> entry?
> 

I'm tending towards the latter suggestion because it's simpler. There's no need to stick to a +1 second scheme etc, and it might mislead people into thinking they can do calculations with this - such as reversing the original timestamp of the sourceful-upload.

Our naming of "SOURCE_DATE_EPOCH" did not really take into account the fact that a source package can be built with many different configurations to create many different build products that are each reproducible themselves. (Debian itself also doesn't do this too clearly, the "+bn" syntax "looks like" it's just a suffix but actually signals an entirely different namespace from source package versions.)

If it helps one sleep better, one can interpret the "SOURCE" in "SOURCE_DATE_EPOCH" to refer to "all implicit and explicit inputs of the build result, including the source code of the package being built but also the binary build dependencies".

(If you want to be super-accurate, you can take the max() of all of the changelogs of all of the transitive build-deps, but I think that's going a bit too far.)

X

-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git