[debhelper-devel] Bug#791823: debhelper: set SOURCE_DATE_EPOCH env var for reproducible builds

Jérémy Bobbio lunar at debian.org
Sun Jul 12 10:03:00 UTC 2015


Hi!

Dhole:
> Also, in order to help reproducible builds, a fixed timezone is exported
> (TZ=UTC).

I am not convinced this change is a good idea. While reviewing new uploads
to the Debian archive, I have at least spotted these lines in
exim4/4.86~RC4-1 changelog [1]:

>   * unexport/undefine TZ in debian/rules for reproducible build. It
>     would be used as default value for TIMEZONE_DEFAULT.

The `TZ` environment variable is not usually set in a build environment.
It is a reproducibility problem if a package produce different binaries
when it is, but that's all. I am afraid that some packages, like exim4,
would silently start behaving differently if we set `TZ` in debhelper.

If we don't set the variable in debhelper, we can use the
reproducibility tests to spot packages who are building differently
depending on the timezone or the value of TZ and propose fixes to
maintainers. This enables them to review their impact. It is indeed more
work, but it's less likely to unknowingly introduce any weird behavior.

 [1]: https://tracker.debian.org/news/694090

-- 
Lunar                                .''`. 
lunar at debian.org                    : :Ⓐ  :  # apt-get install anarchism
                                    `. `'` 
                                      `-   
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/debhelper-devel/attachments/20150712/ca3163f4/attachment-0001.sig>


More information about the debhelper-devel mailing list