Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101356
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain seld.be designates 74.125.82.52 as permitted sender)
To: internals@lists.php.net
References: <20171211211157.d7lj5vibpaaka4ji@gmail.com>
 <CAFMT4NoWuBiNrAu3VjmhjWc_DfoWQa3FfTFxSBwDiDDtkvi8VA@mail.gmail.com>
 <20171214090209.7in22vsbrjaxvsxe@gmail.com>
Message-ID: <0f6e70ad-0b4e-6917-963c-8fcbcca604bb@seld.be>
Date: Fri, 15 Dec 2017 11:13:45 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <20171214090209.7in22vsbrjaxvsxe@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: de-CH
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] Reproducible Builds Support
From: j.boggiano@seld.be (Jordi Boggiano)

On 2017-12-14 10:02 AM, Jelle van der Waa wrote:
>>> The last issue is phar.phar being non-reproducible of which I am not
>>> sure what the issue would be. I'm not sure how the binary data in the
>>> phar.phar is generated.
>>
>> Phars are like `tars` that are also valid PHP files. This means there
>> are probably modification times, etc, set in there. Not sure what else
>> would need to be changed.
> 
> Thanks for the information, I'll see if I can do some more digging.

I have had similar issues with Phar files when I tried to make Composer 
builds reproducible. The cause is that the Phar extension uses the 
current unix timestamp as filemtime for all files in the table of 
content (at least when using addFromString), so every time you build the 
TOC is different and hence the signature at the end also is.

I built a tool to fix this which just overwrites the TOC timestamps with 
whatever you want and then updates the signature.. If it helps, you can 
find it there:

https://github.com/Seldaek/phar-utils

Example usage in Composer:

https://github.com/composer/composer/blob/84f5a1a7e8293978a718663dfac399e83f093e9e/src/Composer/Compiler.php#L161-L164

I guess an alternative fix would be for someone to actually fix the Phar 
extension so addFromString has a filemtime parameter you can pass the 
desired mtime to. I have not checked whether addFile suffers from the 
same issue or not, but possibly it needs to be fixed to read the mtime 
from the file you add.

Best,
Jordi

-- 
Jordi Boggiano
@seldaek - http://seld.be