Re: [Dev-luatex] Reproducible builds using luatex

On 5/4/2016 12:17 PM, luigi scarso wrote:

On Mon, May 2, 2016 at 2:27 PM, Alexis Bienvenüe mailto:pado@passoire.fr> wrote:

Hello.

Working on the “reproducible builds” effort [1], we have noted that a lot of software packages use pdftex/xetex/luatex to build some documents to be included in the binary package. These builds enclose timestamps in the documents, preventing reproducible build. The SOURCE_DATE_EPOCH specification defines an environment variable that is set during software package building and can be used to replace time() calls (or equivalent) for build timestamps.

I would like to promote the SOURCE_DATE_EPOCH support for luatex, which would need two patches in the engine code:

Thank you very much for the patches. The source code now is almost frozen, so it's unlikely (but not impossible) that we can apply the patches proposed. But for sure we will consider them for the next release of luatex.

a few remarks: (1) The name SOURCE_DATE_EPOCH is not a nice one. Also some value has to be taken from the environment it should not sound like some hack but be a proper public environment variable, working on all platforms (linux,windows,osx,..) (2) Any environment variable should be part of the formal web2c specification, i.e. it is bound to the progname so it should then be something initial_time_stamp.pdftex etc (3) We already have ways to set all these pdf state variables in the resulting file and it's already complicated enough. (4) I understand it's needed for some testing so one can even wonder if it's something user level (one can this even consider this to be a security issue, faking dates and so) Hans ----------------------------------------------------------------- Hans Hagen | PRAGMA ADE Ridderstraat 27 | 8061 GH Hasselt | The Netherlands tel: 038 477 53 69 | www.pragma-ade.com | www.pragma-pod.nl -----------------------------------------------------------------