[Dev-luatex] Reproducible builds using luatex

Alexis Bienvenüe pado at passoire.fr
Wed May 4 23:12:48 CEST 2016


Le 04/05/2016 12:34, Hans Hagen a écrit :
> (1) The name SOURCE_DATE_EPOCH is not a nice one. Also some value has to
> be taken from the environment it should not sound like some hack but be
> a proper public environment variable, working on all platforms
> (linux,windows,osx,..)

This name was chosen in the specification:

  https://reproducible-builds.org/specs/source-date-epoch/

It is already used in various programs.

> (3) We already have ways to set all these pdf state variables in the
> resulting file and it's already complicated enough.

Other ways to set both the PDF metadata dates and the \today date imply
modification of the documents or building process of each individual
software package that uses luatex to build documentation. Using an
environment variable allows to share the work.

> (4) I understand it's needed for some testing so one can even wonder if
> it's something user level (one can this even consider this to be a
> security issue, faking dates and so)

>From the document source, anyone can modify it in any way and produce a
PDF document with any date, any content. This is not a security issue.

Regards,
Alexis Bienvenüe.




More information about the dev-luatex mailing list