Make build reproducible by reading envvar SOURCE_DATE_EPOCH if set

[Vincent-C]

As part of the ongoing Reproducible Builds project, packages in Debian/Ubuntu are routinely scanned and tested for build reproducibility. A bug was filed against the pelican package in Debian, so I'm just forwarding the patch that we've applied there to make it build reproducibly, i.e. by attempting to get the current datetime from a standard envvar, SOURCE_DATE_EPOCH, if it's available. Thanks for considering this change!

[justinmayer]

Hi Vincent! Thank you for the submission. As it turns out, datetime.datetime.utcfromtimestamp() is deprecated, so I made a suggested change. Would you please take a look and let me know your thoughts?

[justinmayer]

This change yields the following deprecation warning:

DeprecationWarning: datetime.datetime.utcfromtimestamp() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.fromtimestamp(timestamp, datetime.UTC)

Perhaps the following instead?

year = datetime.datetime.fromtimestamp(
    int(os.environ.get("SOURCE_DATE_EPOCH", time.time())), datetime.timezone.utc
).year

See also:

• https://docs.python.org/3/library/datetime.html#datetime.datetime.utcfromtimestamp
• https://til.simonwillison.net/python/utc-warning-fix

[justinmayer]

I went ahead and made my suggested change so I could include this PR in an imminent new release. Thanks again, Vincent.

[justinmayer]

I just released Pelican 4.11.0, which includes the changes in this pull request.

[Vincent-C]

Thank you!