Avoid storing build time in gzip headers#13
Conversation
This allows to create bit-reproducible Python3.12/Python.devhelp.gz output. See https://reproducible-builds.org/ for why this is good.
|
Thank you for the PR Bernhard. Please can you add a test? I wonder also if we should use SOURCE DATE EPOCH instead, are there any drawbacks to lying to users about the GZip creation time? cc @jayaddison who has done similar work in core Sphinx. A |
|
I think, we should avoid the extra logic of handling I'd appreciate, if you could add the test. I don't have much experience in python. |
|
When it's not possible to remove timestamps entirely from a build process, I think that |
|
Do you have a pointer to some consumer of this file? I cannot imagine why they would use this timestamp. |
|
Ok, thank you @bmwiedemann; no, I'm not aware of any consumers of that timestamp. I'm a Python contributor here but without write access to the repo, and am interested in reproducible builds, so: I propose that I'll open a pull request against your fork soon (within the next few days) to provide the test coverage. |
This has been opened as bmwiedemann#1 - please run/check the test coverage there (it should fail without the fix in place, and pass once the fix is introduced). Note: that pull request is opened against the same branch that this pull request originates from -- so merging that one should result in corresponding updates here (including continuous integration checks). |
Relates-to commit 2e0fc9b.
|
I'm not completely sure what is going on with the |
I believe I've discovered the cause of these (unrelated) type-checking errors, and have opened #14 with a possible solution. |
|
Thanks again! |
Co-authored-by: James Addison <jay@jp-hosting.net> (cherry picked from commit 7278043)
Co-authored-by: James Addison <jay@jp-hosting.net>
This allows to create bit-reproducible Python3.12/Python.devhelp.gz output.
See https://reproducible-builds.org/ for why this is good.
This patch was done while working on reproducible builds for openSUSE, sponsored by the NLnet NGI0 fund.