Skip to content

CPackDeb: Support SOURCE_DATE_EPOCH when packaging

Andrew Fuller requested to merge andrew/cmake:reproducible-tarballs into master

libarchive doesn't respect SOURCE_DATE_EPOCH, but cmTimestamp does. Default the mtime to what cmTimestamp says so that when SOURCE_DATE_EPOCH is set, it is respected. The caller is still free to override the mtime as usual.

This enables reproducible builds of tarballs. Reproducible zips is still outstanding in order for .deb packages to be reproducible. I'm not sure what is desired: omitting the timestamp entirely when zipping data.tar.gz and control.tar.gz (need to expose that functionality through the CMake wrapper of libarchive), or perhaps change libarchive itself to respect SOURCE_DATE_EPOCH when including a timestamp in the zip.

FWIW lintian recommends omitting timestamps of zips: https://lintian.debian.org/tags/package-contains-timestamped-gzip.html

Edited by Andrew Fuller

Merge request reports