Creation time / modification time not propagated from source file [Debian]

[n8willis]

Debian's reproducible-builds project has opened a bug - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774148 - citing the fact that when FontForge is used to build TTFs, it inserts the current (i.e., build) time as the creation time and modification time of the generated font, as opposed to the modification time of the font source.

This causes TTFs generated with FontForge to fail the reproducible-build test, which Debian is moving toward for all packages.

There's a patch included in the downstream bug report. It checks the creation time and mod time of the font source, and uses those as the values written to the TTF. I have not reviewed the patch, only read through it.

[JoesCat]

I'm digging through some rather big patches for native scripting plus libspiro at the moment, but following your lead here... ...I think we need to visit debian font bugs since the bug you list seems to reference two patches, plus imply the need to add scripting 'creation time's in python plus native scripting.
https://bugs.debian.org/cgi-bin/pkgreport.cgi?maint=pkg-fonts-devel%40lists.alioth.debian.org

[n8willis]

I suppose at this point, one thing we could do is see if there is anyone who objects to the change (proposed) itself. Because it still constitutes a change, justifiable or otherwise....

[JoesCat]

On September 17, 2015 09:06:04 AM n8willis wrote:

I suppose at this point, one thing we could do is see if there is anyone
who objects to the change (proposed) itself. Because it still
constitutes a change, justifiable or otherwise....

...appears justifiable, plus looking at the debian page, seems there's a lot
of broken fonts, maybe some are waiting for such a fix as you've indicated.

My main thought for this patch you found is (like any other), please credit
the original author if you can for what they made. They made the effort, so
would be nice to credit them for it. Ideally, they would post a patch
themselves, but that isn't always the case, or sometimes they are too busy,
or moved-on....I don't know.

...Also following the bug you mentioned, I've noted that there seems to be
a couple other bugs that could/might be followed-up if you (or anyone else)
are interested in following-up.

...sometimes bugs like this leads into other things that could be fixed, so
it's a good starting point for people interested in starting somewhere but
not knowing what to do.

...at this moment, I'm a bit loaded with a rather large native scripting
patch (sort of imports mskala's fontanvil builtins table idea, plus I'm
adding a big libspiro patch together but haven't quite settled on some
details.

[n8willis]

Well I don't believe I claimed any credit for the patch; I just said I had read it. If/when it's actionable, we'll obviously credit it to the author....

I will read through other FF bugs in the Debian BTS. You're quite right that we don't have as good of a communications channel open with -- frankly -- any of the distros that package FontForge binaries. Worth working on.

[JoesCat]

On September 18, 2015 12:17:22 PM n8willis wrote:

Well I don't believe I claimed any credit for the patch; I just said I
had read it. If/when it's actionable, we'll obviously credit it to the
author....

True, you didn't claim. :-)
Let's assume there's 99 other readers reading this that don't know ;-)
Sometimes it's worth repeating again, and then again, and then again, for
newcomers interested in participating but lack prior history or contexts.
Sometimes it's worth knowing, sometimes it's unimportant. I think this is
one of "them things" worth mentioning again, and again, if you want to
encourage people to come and help.

I will read through other FF bugs in the Debian BTS. You're quite right
that we don't have as good of a communications channel open with --
frankly -- any of the distros that package FontForge binaries. Worth
working on.

An oil tanker is a massive ship with a tiny engine.
It won't turn on a dime. When it begins to turn, it will be several
kilometers travelled before you see any change of direction.

FontForge is a massive program, with a tiny crew.
...and like a massive oil tanker with a tiny engine, you eventually begin
to see it change direction several kilometers down the path.

Pick-n-choose the battles you can win and improve on.
It's worth checking downstream for bugs and patches every now and then.
Thanks @n8willis !

[mapreri]

Hi there.
I wonder if the patch attached in that bug could be commented.
We can even propose a PR here directly if that can make such review/comments/inclusion easier. :)

[jtanx]

Yes a PR would be appreciated

[lamby]

https://gist.githubusercontent.com/lamby/60a545b37b778e148702c342bbf86bd9/raw/19a39af51d669fde042b261236f65ba72f75662a/903_reproducubile_build.diff

Is an—entirely untested—patch for using SOURCE_DATE_EPOCH.

[lamby]

(Half wrote it before I realised you were trying to remove timestamps altogether, which is a much better idea).

[JoesCat]

Timestamps still important, but you need to maintain compatibility between distros and operating systems. Check libspiro for example.