.a files are ar archives. By default, they will contain a timestamp for each member (.o) and for the function index.

Known affected packages

Detection

Example debbindiff output

Work-around

strip-nondeterminism will normalize .a files the same way binutils does when configured for deterministic mode.

Example patch

Solution

GNU ar and other tools from binutils have a deterministic mode which will use zero for UIDs, GIDs, timestamps, and use consistent file modes for all files.

With `--enable-deterministic-archives`

binutils is now built with --enable-deterministic-archives since version 2.25-6. This means that the default mode of operation is to create deterministic archives.

Just make sure the U flag is not used.

Optional deterministic archives

When binutils is not built with deterministic archives by default, build systems likely have to be patched to pass the right options to ar and friends.

ARFLAGS can be set to Dcvr with many build systems to turn on the deterministic mode. Unfortunately in most cases ranlib will be called to create the function index. As I have yet to see a RANLIBFLAGS variable, it's not possible to pass -D. We then get a timestamp in the .a file.