search

nerves-time / nerves_time

Keep time in sync on Nerves devices
Other
23 stars 13 forks source link

Support reproducible builds #40

Closed fhunleth closed 5 years ago

fhunleth commented 5 years ago

Previously each build of nerves_time resulted in a different binary due to the use of a build timestamp in sane_time.ex. This commit fixes that so that if SOURCE_DATE_EPOCH is set, the timestampe is forced to the specified value. See https://reproducible-builds.org for more information.

fhunleth commented 5 years ago

Upon further reflection and discussion with @mobileoverlord, I'm thinking that the path forward is to hardcode a default earliest timestamp in nerves_time. Then, add the ability to set the earliest timestamp via the application config so that if projects want a later timestamp, they can override it.

This will make nerves_time builds deterministic without needing support for SOURCE_DATE_EPOCH.

The main issue that's bothering me with using SOURCE_DATE_EPOCH is that it should be legal for someone to set it to Jan 1, 1970 or similar old date. That has a pretty serious repercussion of disallowing dates after 1990 right now due to the "sane" date check only allowing dates within a 20 year window. That, of course, can be worked around with a bigger window, but it just seems simpler to expose the valid date window to the user in the application config and provide a reasonable one as a default.

fhunleth commented 5 years ago

Update: this PR no longer works as the original. It hardcodes the timestamp and allows users to override it. SOURCE_DATE_EPOCH is no longer needed. This just simplifies everything and the whole library is reproducible by default.

This PR has some minor commits that I found while making the updates.