Subject: Re: bug#32342: [PATCH] Do not store mtime when compressing stdin

From: "Bernhard M. Wiedemann" <[email-masked]>
Date: Thu, 2 Aug 2018 10:31:32 +0200

On 2018-08-02 08:47, Paul Eggert wrote:
> Bernhard M. Wiedemann wrote:
>> This allows for reproducible output of
>> echo foo | gzip | md5sum
> 
> gzip -n already does that, so we don't need to change the gzip source
> code to get reproducible output.

I know that it does, but patching hundreds of packages [1] (including
ones still to be created) doing
tar -czf $file
to do instead
tar -c | gzip -n > $file

is a lot more effort than this one-line patch.
It is also worth noting that the first variant works without a shell
involved, so is easier+safer to call from other programs via system(3).

Is there a good reason to want the current time in .gz in this situation?
I found that .bz2 and .xz dont carry it either.

If there is a good reason, we could probably make it so that
echo foo | gzip -N
triggers the old default behaviour again.

Another possible approach would be to use the $SOURCE_DATE_EPOCH
environment variable's value instead of the current time,
as defined in
https://reproducible-builds.org/specs/source-date-epoch/

This would leave the default behaviour as is, but fix reproducible
builds for us, because the variable is set in our package build environment.

I'd just really like to have it reproducible by default.

[1]
https://github.com/performancecopilot/pcp/pull/540
https://github.com/L1L1/cardpeek/pull/97
https://github.com/singularityware/singularity/pull/1083
https://sourceforge.net/p/x3270/code/merge-requests/1/
https://stat.ethz.ch/pipermail/r-devel/2017-April/074165.html