On Thu Nov 10, 2022 at 15:23 -0500, Ben Cotton wrote:
https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
The `%clamp_mtime_to_source_date_epoch` RPM macro will be set to `1`.
When an RPM package is built, mtimes of packaged files will be clamped
to `$SOURCE_DATE_EPOCH` which is already set to the date of the latest
`%changelog` entry. As a result, more RPM packages will be
reproducible: The actual modification time of files that are e.g.
modified in the `%prep` section or built in the `%build` section will
not be reflected in the resulting RPM packages. Files in RPM packages
will have mtimes that are independent of the time of the actual build.
Will packagers still be required to use install -p, cp -p, etc. to
preserve mtimes? For some packages, the source archives mtimes will be
lower than $SOURCE_DATE_EPOCH, but e.g. for ancillary Source files (e.g.
systemd units) stored in distgit, using -p won't make a difference,
because the mtimes aren't preserved when Koji clones the distgit
repository.
--
Best,
Maxwell G (@gotmax23)
Pronouns: He/Him/His