# [Dev-luatex] Reproducible builds using luatex

Hans Hagen pragma at wxs.nl
Wed May 4 12:48:58 CEST 2016

```On 5/4/2016 12:34 PM, Hans Hagen wrote:
> On 5/4/2016 12:17 PM, luigi scarso wrote:
>>
>>
>> On Mon, May 2, 2016 at 2:27 PM, Alexis Bienvenüe <pado at passoire.fr
>>
>>     Hello.
>>
>>     Working on the “reproducible builds” effort [1], we have noted that a
>>     lot of software packages use pdftex/xetex/luatex to build some
>> documents
>>     to be included in the binary package. These builds enclose
>> timestamps in
>>     the documents, preventing reproducible build. The SOURCE_DATE_EPOCH
>>     specification defines an environment variable that is set during
>>     software package building and can be used to replace time() calls (or
>>     equivalent) for build timestamps.
>>
>>     I would like to promote the SOURCE_DATE_EPOCH support for luatex,
>> which
>>     would need two patches in the engine code:
>>
>>
>> Thank you very much for the patches.
>> The source code now is almost frozen, so it's unlikely (but not
>> impossible) that we can apply the patches
>> proposed.  But for sure we will consider them  for the next  release of
>> luatex.
>
> a few remarks:
>
> (1) The name SOURCE_DATE_EPOCH is not a nice one. Also some value has to
> be taken from the environment it should not sound like some hack but be
> a proper public environment variable, working on all platforms
> (linux,windows,osx,..)
>
> (2) Any environment variable should be part of the formal web2c
> specification, i.e. it is bound to the progname so it should then be
> something initial_time_stamp.pdftex etc
>
> (3) We already have ways to set all these pdf state variables in the
> resulting file and it's already complicated enough.
>
> (4) I understand it's needed for some testing so one can even wonder if
> it's something user level (one can this even consider this to be a
> security issue, faking dates and so)

btw, i can imagine a \systemtime primitive counter that one can set and
consult and that will initialize from systemtime.<progname> and that a
macro package can consult and use to set whatever it wants to set in
front- and backend, which is more generic and flexible because in pdf
files there's all kind of data with time related properties (xmp date etc)

Hans

-----------------------------------------------------------------