From: David Ward on
gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/issues/39#note_562573307
I think I lumped too many different things together, and I'd like to
focus on just one question that is important to me.
If someone checks out a specific tag in kernel-ark (which in turn
corresponds to a specific upstream commit), and runs `make dist-all-rpm`
to produce a package — how can we make sure it produces exactly the same
NVR, regardless of what the system clock says when that command is run?
I believe the correct answer is, for snapshots, we should replace `date
+%Y%m%d` with the date that the tagged commit was made in kernel-ark.
(This is _not_ an upstream commit merged by Linus; it is a commit on the
`os-build` branch.) If that tagged commit is `$(HEAD)`, then the date
would be `git show -s --format=%cd --date=format:%Y%m%d $(HEAD)`.
If I'm interested in the exact time that a build was run, rather than
what sources the build contains, that information exists outside of the
NVR. The RPM package metadata contains the build date. Koji [also
shows](https://koji.fedoraproject.org/koji/buildinfo?buildID=1740788)
when the build task was started and completed.