Re: Builds not reproducible on armhf

On Mon, 20 May 2024, Mechtilde Stehmann wrote:

> There are several with FTBR. I found that the day of the *.poms s a date from
> 1970.

I’ve had a look at this. The files have various, *differing*,
timestamps within the month of January 1970, which in itself
is not proper.

It’s not a t64-related JDK bug: I tested…

import java.io.*;

class T1 {
        public static void main(String args[]) throws IOException {
                File sf = new File("T1.java");
                File df = new File("T1.out");
                System.out.println(sf.lastModified());
                InputStream is = new FileInputStream(sf);
                OutputStream os = new FileOutputStream(df);
                byte[] data = new byte[32768];
                int nbytes = is.read(data);
                os.write(data, 0, nbytes);
                os.close();
                is.close();
                df.setLastModified(sf.lastModified());
        }
}

… on armhf with OpenJDK 8, 17 and 21 (11 needs t64-transitioning).

Given the range of January 1970…

$ TZ=UTC date -d '1970-01-31T23:59:59Z' +%s
2678399
$ TZ=UTC date -d @2678399000
Sun Nov 15 23:43:20 UTC 2054

… it is entirely possible that someone confused time_t and
Java millis, so the timestamps are off by a factor of 1000.

-rw-r--r--···0·root·········(0)·root·········(0)·····1415·1970-01-06·08:03:05.000000·./usr/share/maven-repo/com/github/mangstadt/vinnie/2.0.2/vinnie-2.0.2.pom
-rw-r--r--···0·root·········(0)·root·········(0)·····1415·1970-01-03·13:27:14.000000·./usr/share/maven-repo/com/github/mangstadt/vinnie/2.0.2/vinnie-2.0.2.pom

-rw-r--r--···0·root·········(0)·root·········(0)·····1416·1970-01-09·01:36:03.000000·./usr/share/maven-repo/com/github/mangstadt/vinnie/debian/vinnie-debian.pom
-rw-r--r--···0·root·········(0)·root·········(0)·····1416·1970-01-04·21:40:23.000000·./usr/share/maven-repo/com/github/mangstadt/vinnie/debian/vinnie-debian.pom

$ for t in 1970-01-06T08:03:05 1970-01-03T13:27:14 \
    1970-01-09T01:36:03 1970-01-04T21:40:23; do \
	TZ=UTC date -d @$(TZ=UTC date -d "${t}Z" +%s)000; \
  done

Fri Aug 10 11:23:20 UTC 1984
Tue Jan  4 13:53:20 UTC 1977
Sat Feb  1 16:50:00 UTC 1992
Mon Sep  8 01:03:20 UTC 1980

Okaaay… So, maybe not so much. I *was* guessing something with
DEB_SOURCE_EPOCH vs. project.build.outputTimestamp, but that’s
apparently not it either.

So I fear someone’ll have to dig through all the various Maven-
related source packages…

FWIW, the 517-day-old .deb currently in the repo has…

-rw-r--r-- root/root      1415 2022-12-17 18:36 ./usr/share/maven-repo/com/github/mangstadt/vinnie/2.0.2/vinnie-2.0.2.pom

… which matches Sat, 17 Dec 2022 18:36:19 +0100 from d/changelog,
so something something reproducible-builds is still suspect.

Good luck with that,
//mirabilos
-- 
Infrastrukturexperte • Qvest Digital AG
Am Dickobskreuz 10, D-53121 Bonn • https://www.qvest-digital.com/
Telephon +49 228 54881-393 • Fax: +49 228 54881-235
HRB AG Bonn 18196 • USt-ID (VAT): DE274355441
Vorstand: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg
Vorsitzender Aufsichtsrat: Peter Nöthen