Open raboof opened 3 months ago
Interesting! I wonder if they'd be open to determining build_date
based on SOURCE_DATE_EPOCH
I would argue that the dynamic releases as introduced in https://gitlab.gnome.org/GNOME/nautilus/-/commit/5a4fc5664e05f7633894ebb564a7e0b0e73c2e0f should not be used in stable releases in the first place. Instead the stable versions should be added as suggested by the comment in https://gitlab.gnome.org/GNOME/nautilus/-/commit/979891166ad36e3352322e22f23b3cd20b0a7ff. Ideally with release notes (example) so that libadwaita can display what’s new in the about dialogue. (And generate the NEWS file from the XML then.)
And for snapshots, it should use the commit date, not the current or fake one. That can be easily, if uglily obtained in Meson:
vcs_tag(
command: ['git', 'show', '-s', '--format=%cs'],
input: configure_file(
input: files('org.gnome.Nautilus.appdata.xml.in.in.in'),
output: 'org.gnome.Nautilus.appdata.xml.in.in',
configuration: appdata_conf
),
output:'gnome.Nautilus.appdata.xml.in',
replace_string:'@BUILD_DATE@',
)
By the way, looks like GTK dropped the date altogether but that probably makes it invalid AppStream file.
Building this package multiple times does not yield bit-by-bit identical results, complicating the detection of Continuous Integration (CI) breaches. For more information on this issue, visit reproducible-builds.org.
Fixing bit-by-bit reproducibility also has additional advantages, such as avoiding hard-to-reproduce bugs, making content-addressed storage more effective and reducing rebuilds in such systems.
Steps To Reproduce
In the following steps, replace
<package>
with the canonical name of the package.1. Build the package
This step will build the package. Specific arguments are passed to the command to keep the build artifacts so we can compare them in case of differences.
Execute the following command:
Or using the new command line style:
2. Compare the build artifacts
If the previous command completes successfully, no differences were found and there's nothing to do, builds are reproducible. If it terminates with the error message
error: derivation '<X>' may not be deterministic: output '<Y>' differs from '<Z>'
, usediffoscope
to investigate the discrepancies between the two build outputs. You may need to add the--exclude-directory-metadata recursive
option to ignore files and directories metadata (e.g. timestamp) differences.3. Examine the build log
To examine the build log, use:
Or with the new command line style:
Additional context
Diffoscope shows the build uses the build date (rather than the source date) as the 'release date' in
org.gnome.Nautilus.metainfo.xml
:/cc @bobby285271 @hedning @jtojnar @dasj19
Add a :+1: reaction to issues you find important.