In Arch Linux our automake package includes /usr/share/doc/automake/amhello-1.0.tar.gz. When we rebuild this package using our rebuilder to check for reproduciblity the uid/gid and timestamps are not normalized meaning they vary per rebuild making the package non-reproducible. [1] [2]

The owner/guid could be set --owner=root:0 --group=root:0
and to get rid of the timestamp --mtime='@0' (Or alternatively a fixed timestamp which can be set via SOURCE_DATE_EPOCH).

Alternatively the timestamp could be excluded by hardcoding the tar format to ustar which omits timestamps.

[1] https://reproducible.archlinux.org
[2] https://reproducible-builds.org/



Reply via email to