On 2018-08-02 08:47, Paul Eggert wrote: > Bernhard M. Wiedemann wrote: >> This allows for reproducible output of >> echo foo | gzip | md5sum > > gzip -n already does that, so we don't need to change the gzip source > code to get reproducible output.
I know that it does, but patching hundreds of packages [1] (including ones still to be created) doing tar -czf $file to do instead tar -c | gzip -n > $file is a lot more effort than this one-line patch. It is also worth noting that the first variant works without a shell involved, so is easier+safer to call from other programs via system(3). Is there a good reason to want the current time in .gz in this situation? I found that .bz2 and .xz dont carry it either. If there is a good reason, we could probably make it so that echo foo | gzip -N triggers the old default behaviour again. Another possible approach would be to use the $SOURCE_DATE_EPOCH environment variable's value instead of the current time, as defined in https://reproducible-builds.org/specs/source-date-epoch/ This would leave the default behaviour as is, but fix reproducible builds for us, because the variable is set in our package build environment. I'd just really like to have it reproducible by default. [1] https://github.com/performancecopilot/pcp/pull/540 https://github.com/L1L1/cardpeek/pull/97 https://github.com/singularityware/singularity/pull/1083 https://sourceforge.net/p/x3270/code/merge-requests/1/ https://stat.ethz.ch/pipermail/r-devel/2017-April/074165.html
signature.asc
Description: OpenPGP digital signature
