__DATE__, __TIME__ and __TIMESTAMP are part of the standard predefined macros of the C pre-processor.

Usage of these macros must simply be removed in order to builds reproducible.

Known affected packages

Detection

With the experimental toolchain, packages properly using dpkg-buildflags will fail to build. Example build log.

For those who don't, the Build Id will be different. Example debbindiff output.

According to CodeSearch, there's quite a few packages using these macros.

Solution

The preliminary step is to add support for dpkg-buildflags if it's not there already.

Remove usage of these macros. Example patch.

Sometimes it may not be desirable to remove the macros from the source code: it may break something or the maintainer may not want it. In that case, a suggested approach is to create a define that can replace __DATE__ and __TIME__ if it is set externally (with the desired date), and set it to he latest debian/changelog entry. Example patch.

As a general solution, following the proposed timestamp standard environment variable SOURCE_DATE_EPOCH that would be set by debhelper during the build with the last debian/changelog timestamp, a patch to GCC has been sent supporting this feature; the macros __DATE__ and __TIME__ would be replaced by the date/time provided by SOURCE_DATE_EPOCH in case the env var is set. gcc-patches mailing list thread.

Prevention

gcc-4.9 introduced a new warning -Wdate-time which will warn when they are used. dpkg-buildflags from dpkg 1.17.14 or later passes -Wdate-time to debian/rules when DEB_BUILD_MAINT_OPTIONS=reproducible=+timeless is set. We need to follow some steps before this can be turned on by default. Eventually the warnings can be turned into errors with the -Werror=date-time flag as already done in the experimental toolchain.