Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122824
Message-ID: <fbf0dfae-5aae-40dc-bdbb-a37daec2c1bc@bastelstu.be>
Date: Sat, 30 Mar 2024 15:21:20 +0100
Precedence: bulk
MIME-Version: 1.0
Subject: Re: [PHP-DEV] Consider removing autogenerated files from tarballs
To: Stanislav Malyshev <smalyshev@gmail.com>,
 Sebastian Bergmann <sebastian@php.net>,
 PHP Internals <internals@lists.php.net>
References: <AM8P250MB01705B564C0F9B2F460F56B0E2392@AM8P250MB0170.EURP250.PROD.OUTLOOK.COM>
 <9008050F-4EE1-4E19-B513-654602E118A7@benramsey.com>
 <3d90e236-49d8-4f80-a6dd-3584267a83e3@php.net>
 <586c3320-b38b-47bb-9c06-6762f1eb242b@gmail.com>
Content-Language: en-US
In-Reply-To: <586c3320-b38b-47bb-9c06-6762f1eb242b@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

Hi

On 3/30/24 14:20, Stanislav Malyshev wrote:
>> But does the release manager generate the files (and the tarball) in a
>> reproducible way?
> 
> I understand that's what ./scripts/dev/makedist and
> ./scripts/dev/genfiles do, but I suspect exact bits in resulting
> configure and lexers may depend on the exact version of tools & utils
> used. For upstream packagers like distros I'd likely recommend using
> these tools directly anyway, and not rely on what's in the package.
> 

I've made some improvements to the 'makedist' script last year to 
improve reproducibility [1], but they are not fully reproducible yet.

Notably the timestamps within the .tar archive are not reproducible yet: 
https://github.com/php/php-src/blob/186465b1ddcf203ddffb5d24bae897508c711586/scripts/dev/makedist#L169-L172

They are set to the time the script is run, but should probably be 
derived from the time of the current commit instead. Likewise the gzip 
call does not have the -n flag and thus also embeds a timestamp into the 
.tar.gz archive.

There are probably further bits that are not reproducible yet.

Best regards
Tim Düsterhus

[1] https://github.com/php/php-src/pull/10613 and 
https://github.com/php/php-src/pull/10615