Re: RFC: Sort tarballs created by the src-release.sh script

[Jan Beulich <jbeulich@suse.com>]

On 02.10.2022 09:54, Sam James wrote:
> 
> 
>> On 30 Sep 2022, at 12:38, Nick Clifton via Binutils <binutils@sourceware.org> wrote:
>>
>> Hi Guys,
>>
>>  Right, here is the latest and greatest - and hopefully last - version
>>  of the patch.  I added a parseable string to the --mtime option and a
>>  comment explaining why these options are being used.
>>
>>  Any more comments/suggestions ?
>>
>> Cheers
>>  Nick
>>
>> diff --git a/src-release.sh b/src-release.sh
>> index 079b545ae7c..8a2ac125030 100755
>> --- a/src-release.sh
>> +++ b/src-release.sh
>> @@ -184,9 +184,11 @@ do_tar()
>>     ver=$2
>>     echo "==> Making $package-$ver.tar"
>>     rm -f $package-$ver.tar
>> +    # The sort command and --mtime, --group and --owner options are
>> +    # used in order to create consistent, reproducible tarballs.
>>     find $package-$ver -follow \( $CVS_NAMES \) -prune \
>> -       -o -type f -print \
>> -       | tar cTfh - $package-$ver.tar
>> +       -o -type f -print | LC_ALL=C sort \
>> +       | tar cTfh - $package-$ver.tar --mtime="1970-01-01 00:00:00" --group=0 --owner=0
>> }
>>
>> # Compress the output with bzip2
>>
> 
> I think this might hit a problem I faced when trying to do this with Go tarballs: https://www.gnu.org/software/tar/manual/tar.html#warnings.
> 
> With that date, I got "implausibly old time stamp" warnings from tar. I haven't tested this patchthough (writing from mobile, apologies).
> 
> Maybe default to the creation date of Binutils and allow overriding via https://reproducible-builds.org/docs/source-date-epoch/?

Not sure what "creation date" might mean here. Assuming the script is
(typically) run from a git tree, perhaps the commit date of the top
level commit on the branch would be best to use?

Jan