Differences between revisions 10 and 11
Revision 10 as of 2015-10-18 22:55:09
Size: 2862
Editor: JensReyer
Comment: Typo
Revision 11 as of 2016-01-01 15:35:38
Size: 2715
Editor: ChrisWest
Comment: -Werror=date-time now on by default
Deletions are marked like this. Additions are marked like this.
Line 28: Line 28:
`gcc-4.9` [[https://gcc.gnu.org/gcc-4.9/changes.html#languages|introduced]] a new warning `-Wdate-time` which will warn when they are used. dpkg-buildflags from dpkg 1.17.14 or later passes `-Wdate-time` to debian/rules when `DEB_BUILD_MAINT_OPTIONS=reproducible=+timeless` is set. We need to follow some [[https://wiki.debian.org/Teams/Dpkg/FAQ#Q:_Can_we_add_support_for_new_default_build_flags_to_dpkg-buildflags.3F|steps]] before this can be turned on by default. Eventually the warnings can be turned into errors with the `-Werror=date-time` flag as already done in the experimental toolchain. `gcc-4.9` [[https://gcc.gnu.org/gcc-4.9/changes.html#languages|introduced]] a new warning `-Wdate-time` which will warn when they are used.  This is on by default since [[https://tracker.debian.org/news/736046|dpkg 1.18.4 (2015-12-25 in Unstable]].

dpkg-buildflags from dpkg 1.17.14 or later passes `-Wdate-time` to debian/rules when `DEB_BUILD_MAINT_OPTIONS=reproducible=+timeless` is set. [[https://bugs.debian.org/805872|Old tracking ticket.]]

__DATE__, __TIME__ and __TIMESTAMP are part of the standard predefined macros of the C pre-processor.

Usage of these macros must simply be removed in order to builds reproducible.

Known affected packages

Detection

With the experimental toolchain, packages properly using dpkg-buildflags will fail to build. Example build log.

For those who don't, the Build Id will be different. Example debbindiff output.

According to CodeSearch, there's quite a few packages using these macros.

Solution

The preliminary step is to add support for dpkg-buildflags if it's not there already.

Remove usage of these macros. Example patch.

Sometimes it may not be desirable to remove the macros from the source code: it may break something or the maintainer may not want it. In that case, a suggested approach is to create a define that can replace __DATE__ and __TIME__ if it is set externally (with the desired date), and set it to the latest debian/changelog entry. Example patch.

As a general solution, following the proposed timestamp standard environment variable SOURCE_DATE_EPOCH that would be set by debhelper during the build with the last debian/changelog timestamp, a patch to GCC has been sent supporting this feature; the macros __DATE__ and __TIME__ would be replaced by the date/time provided by SOURCE_DATE_EPOCH in case the env var is set. gcc-patches mailing list thread.

Prevention

gcc-4.9 introduced a new warning -Wdate-time which will warn when they are used. This is on by default since dpkg 1.18.4 (2015-12-25 in Unstable.

dpkg-buildflags from dpkg 1.17.14 or later passes -Wdate-time to debian/rules when DEB_BUILD_MAINT_OPTIONS=reproducible=+timeless is set. Old tracking ticket.