Re: RFC: Sort tarballs created by the src-release.sh script

[Nick Clifton <nickc@redhat.com>]

Hi Guys,

   [This appears to be getting slightly out of hand...]

> Not sure what "creation date" might mean here. Assuming the script is > (typically) run from a git tree, perhaps the commit date of the top> level commit on the branch would be best to use?
Except that a commit to the branch that does not affect something that
would go into the tarball would then result in a changed date.

We could use the src-release.sh file itself, like this:

diff --git a/src-release.sh b/src-release.sh
index 079b545ae7c..de1f98a70bb 100755
--- a/src-release.sh
+++ b/src-release.sh
@@ -184,9 +184,15 @@ do_tar()
      ver=$2
      echo "==> Making $package-$ver.tar"
      rm -f $package-$ver.tar
+    # The sort command and --mtime, --group and --owner options are
+    # used in order to create consistent, reproducible tarballs.
+    # BUILD_DATE is set to SOURCE_DATE_EPOCH if defined, or the
+    # modification date of this file otherwise.  cf:
+    # https://reproducible-builds.org/docs/source-date-epoch/
+    BUILD_DATE="$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date -r src-release.sh +%s)}" +%Y-%m-%d)"
      find $package-$ver -follow \( $CVS_NAMES \) -prune \
-       -o -type f -print \
-       | tar cTfh - $package-$ver.tar
+       -o -type f -print | LC_ALL=C sort \
+       | tar cTfh - $package-$ver.tar --mtime=$BUILD_DATE --group=0 --owner=0
  }

  # Compress the output with bzip2


Would that work ?

Cheers
   Nick