[Dev-luatex] Reproducible builds using luatex

Hans Hagen pragma at wxs.nl
Wed May 4 12:34:03 CEST 2016

On 5/4/2016 12:17 PM, luigi scarso wrote:
> On Mon, May 2, 2016 at 2:27 PM, Alexis Bienvenüe <pado at passoire.fr
> <mailto:pado at passoire.fr>> wrote:
>     Hello.
>     Working on the “reproducible builds” effort [1], we have noted that a
>     lot of software packages use pdftex/xetex/luatex to build some documents
>     to be included in the binary package. These builds enclose timestamps in
>     the documents, preventing reproducible build. The SOURCE_DATE_EPOCH
>     specification defines an environment variable that is set during
>     software package building and can be used to replace time() calls (or
>     equivalent) for build timestamps.
>     I would like to promote the SOURCE_DATE_EPOCH support for luatex, which
>     would need two patches in the engine code:
> Thank you very much for the patches.
> The source code now is almost frozen, so it's unlikely (but not
> impossible) that we can apply the patches
> proposed.  But for sure we will consider them  for the next  release of
> luatex.

a few remarks:

(1) The name SOURCE_DATE_EPOCH is not a nice one. Also some value has to 
be taken from the environment it should not sound like some hack but be 
a proper public environment variable, working on all platforms 

(2) Any environment variable should be part of the formal web2c 
specification, i.e. it is bound to the progname so it should then be 
something initial_time_stamp.pdftex etc

(3) We already have ways to set all these pdf state variables in the 
resulting file and it's already complicated enough.

(4) I understand it's needed for some testing so one can even wonder if 
it's something user level (one can this even consider this to be a 
security issue, faking dates and so)


                                           Hans Hagen | PRAGMA ADE
               Ridderstraat 27 | 8061 GH Hasselt | The Netherlands
       tel: 038 477 53 69 | www.pragma-ade.com | www.pragma-pod.nl

More information about the dev-luatex mailing list