Use SOURCE_DATE_EPOCH if available in the environment.

[lamby]

Whilst working on the Reproducible Builds effort [0], we noticed
that node-marked-man generated reproducible output. In particular,
it uses the current timestamp which varies between builds.

Patch attached that uses SOURCE_DATE_EPOCH[1] if that is exported
in the environment.

[0] https://reproducible-builds.org/
[1] https://reproducible-builds.org/specs/source-date-epoch/

Signed-off-by: Chris Lamb chris@chris-lamb.co.uk

[kapouer]

I believe the right way to fix this is to use --date $SOURCE_DATE_EPOCH command-line option.

[kapouer]

Done in version 0.3.0

[lamby]

@kapouer

I believe the right way to fix this is to use --date $SOURCE_DATE_EPOCH command-line option.

Thanks for the change so that accepts a timestamp. However, I saw that command line option and you are correct that you could pass the timestamp there. However, node-marked-man is often called from within Makefiles and suchforth, so to ensure a reproducible build one would have to patch all of these.

Making node-marked-man defaulting to using SOURCE_DATE_EPOCH if it's available (and, say, --date is not overrriding it) is really ideal. In Debian, we export SOURCE_DATE_EPOCH for builds so this would make all packages using node-marked-man reproducible at a stroke and is much much cleaner.

So, I believe this issue is still outstanding.

[kapouer]

I don't, you can't expect upstream to implement debian-related woes. It's up to debian to update their scripts.

[lamby]

Oh, this isn't a Debian-specific woe or a Debian-specific concern; Homebrew, LEDE, OpenSUSE, Fedora, OpenWRT, Nix, Tails, etc. all export this variable and generally expect it to do the right thing :) (I only mentioned Debian as a concrete example)

And the scripts in question are in other node modules, not in Debian-specific scripts. For example in loose-envify, semver, sshpk etc. etc. but there are many more.

[kapouer]

ok ok, i might reconsider, just give me some time (or more examples, like what about other documentation generators) to make my mind.

[lamby]

Sure, see doxygen, naturaldocs, latex, asciidoc, man2html,groovydoc, groff (ie. UNIX man), htmldoc, lua's ldoc, Haskell's "haddock", texi2html, sphinx, pod2man, Erlang's edoc. Enough? :)

[lamby]

Gentle ping on this?

[kapouer]

I'll release a new version soon.

[lamby]

Thanks!