Skip to content

Reproducible Builds: Use SOURCE_DATE_EPOCH for build time if present

kpcyrd requested to merge kpcyrd/gitlab:repro-builds into master

What does this MR do?

The gitlab-workhorse package currently fails in the Arch Linux Reproducible Builds setup with this diff:

│ │ ├── readelf --wide --decompress --hex-dump=.rodata {}
│ │ │ @@ -356560,15 +356560,15 @@
│ │ │    0x016a2cd0 6e74696d 652f6367 6f3a2000 00000000 ntime/cgo: .....
│ │ │    0x016a2ce0 02000000 14000000 00000000 00000000 ................
│ │ │    0x016a2cf0 02000000 14000000 00000000 00000000 ................
│ │ │    0x016a2d00 0f0e0d0c 0b0a0908 07060504 03020100 ................
│ │ │    0x016a2d10 01000000 00000000 00000000 000000c2 ................
│ │ │    0x016a2d20 00000000 00000000 00000000 00000000 ................
│ │ │    0x016a2d30 02000000 1c000000 24010000 24010000 ........$...$...
│ │ │ -  0x016a2d40 32303231 30333233 2e303032 31333500 20210323.002135.
│ │ │ +  0x016a2d40 32303231 30373038 2e313234 39323100 20210708.124921.
│ │ │    0x016a2d50 d42b4454 01000000 9615e4c6 01000000 .+DT............
│ │ │    0x016a2d60 d0971975 01000000 9e00aacc 00000000 ...u............
│ │ │    0x016a2d70 410671db 01000000 411601f7 01000000 A.q.....A.......
│ │ │    0x016a2d80 02000000 1a000000 49020000 49020000 ........I...I...
│ │ │    0x016a2d90 01000000 00000000 00000000 00000000 ................
│ │ │    0x016a2da0 63616c6c 20667261 6d652074 6f6f206c call frame too l
│ │ │    0x016a2db0 61726765 70746872 6561645f 63726561 argepthread_crea

With this patch, we check if SOURCE_DATE_EPOCH is set and use the value as a UTC timestamp if present.

This value is automatically set by various build systems, you can read more about it here: https://reproducible-builds.org/docs/source-date-epoch/

Screenshots or Screencasts (strongly suggested)

With the patch applied:

Untitled

How to setup and validate locally (strongly suggested)

Build the binary with SOURCE_DATE_EPOCH=0, the binary should then contain a 1970-01-01 build time. This can be verified with strings and grep as well.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Edited by kpcyrd

Merge request reports