[buildd-tools-devel] Bug#843773: Bug#843773: misleading timestamps in binnmus

[Ximin Luo]

(resending again to the correct addresses; I could never get used to debbugs CC behaviour.)

Ximin Luo:
> Ansgar Burchardt wrote:
>> The date from the last sourceful upload should probably still be used
>> for any date/time information included in generated files to ensure
>> they are identical on all architectures (or at least to try to do so).
>>
>> If you change the date in the binNMU entry, SOURCE_DATE_EPOCH should
>> probably be set to the date of the last sourceful upload (instead of
>> just using the most recent changelog entry).
>>
> 
> Holger Levsen wrote:
>> On Thu, Nov 10, 2016 at 08:59:48AM -0200, Johannes Schauer wrote:
>>> One solution would be to increase SOURCE_DATE_EPOCH by 1 second for every
>>> binNMU to a package.
>>>
>>> Any other ideas?
>>
>> set SOURCE_DATE_EPOCH to the creation time of that changelog.$arch
>> entry?
>>
> 
> I'm tending towards the latter suggestion because it's simpler. There's no need to stick to a +1 second scheme etc, and it might mislead people into thinking they can do calculations with this - such as reversing the original timestamp of the sourceful-upload.
> 
> Our naming of "SOURCE_DATE_EPOCH" did not really take into account the fact that a source package can be built with many different configurations to create many different build products that are each reproducible themselves. (Debian itself also doesn't do this too clearly, the "+bn" syntax "looks like" it's just a suffix but actually signals an entirely different namespace from source package versions.)
> 
> If it helps one sleep better, one can interpret the "SOURCE" in "SOURCE_DATE_EPOCH" to refer to "all implicit and explicit inputs of the build result, including the source code of the package being built but also the binary build dependencies".
> 
> (If you want to be super-accurate, you can take the max() of all of the changelogs of all of the transitive build-deps, but I think that's going a bit too far.)
> 
> X
> 

-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git