On Mon, 20 May 2024, Mechtilde Stehmann wrote:
> There are several with FTBR. I found that the day of the *.poms s a date from
> 1970.
I’ve had a look at this. The files have various, *differing*,
timestamps within the month of January 1970, which in itself
is not proper.
It’s not a t64-related JDK bug: I tested…
import java.io.*;
class T1 {
public static void main(String args[]) throws IOException {
File sf = new File("T1.java");
File df = new File("T1.out");
System.out.println(sf.lastModified());
InputStream is = new FileInputStream(sf);
OutputStream os = new FileOutputStream(df);
byte[] data = new byte[32768];
int nbytes = is.read(data);
os.write(data, 0, nbytes);
os.close();
is.close();
df.setLastModified(sf.lastModified());
}
}
… on armhf with OpenJDK 8, 17 and 21 (11 needs t64-transitioning).
Given the range of January 1970…
$ TZ=UTC date -d '1970-01-31T23:59:59Z' +%s
2678399
$ TZ=UTC date -d @2678399000
Sun Nov 15 23:43:20 UTC 2054
… it is entirely possible that someone confused time_t and
Java millis, so the timestamps are off by a factor of 1000.
-rw-r--r--···0·root·········(0)·root·········(0)·····1415·1970-01-06·08:03:05.000000·./usr/share/maven-repo/com/github/mangstadt/vinnie/2.0.2/vinnie-2.0.2.pom
-rw-r--r--···0·root·········(0)·root·········(0)·····1415·1970-01-03·13:27:14.000000·./usr/share/maven-repo/com/github/mangstadt/vinnie/2.0.2/vinnie-2.0.2.pom
-rw-r--r--···0·root·········(0)·root·········(0)·····1416·1970-01-09·01:36:03.000000·./usr/share/maven-repo/com/github/mangstadt/vinnie/debian/vinnie-debian.pom
-rw-r--r--···0·root·········(0)·root·········(0)·····1416·1970-01-04·21:40:23.000000·./usr/share/maven-repo/com/github/mangstadt/vinnie/debian/vinnie-debian.pom
$ for t in 1970-01-06T08:03:05 1970-01-03T13:27:14 \
1970-01-09T01:36:03 1970-01-04T21:40:23; do \
TZ=UTC date -d @$(TZ=UTC date -d "${t}Z" +%s)000; \
done
Fri Aug 10 11:23:20 UTC 1984
Tue Jan 4 13:53:20 UTC 1977
Sat Feb 1 16:50:00 UTC 1992
Mon Sep 8 01:03:20 UTC 1980
Okaaay… So, maybe not so much. I *was* guessing something with
DEB_SOURCE_EPOCH vs. project.build.outputTimestamp, but that’s
apparently not it either.
So I fear someone’ll have to dig through all the various Maven-
related source packages…
FWIW, the 517-day-old .deb currently in the repo has…
-rw-r--r-- root/root 1415 2022-12-17 18:36
./usr/share/maven-repo/com/github/mangstadt/vinnie/2.0.2/vinnie-2.0.2.pom
… which matches Sat, 17 Dec 2022 18:36:19 +0100 from d/changelog,
so something something reproducible-builds is still suspect.
Good luck with that,
//mirabilos
--
Infrastrukturexperte • Qvest Digital AG
Am Dickobskreuz 10, D-53121 Bonn • https://www.qvest-digital.com/
Telephon +49 228 54881-393 • Fax: +49 228 54881-235
HRB AG Bonn 18196 • USt-ID (VAT): DE274355441
Vorstand: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg
Vorsitzender Aufsichtsrat: Peter Nöthen
