Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make the build reproducible #430

Conversation

@lamby
Copy link
Contributor

lamby commented Feb 15, 2020

Whilst working on the Reproducible Builds effort I noticed that mate-desktop could not be built reproducibly.

This is is because it generated a "release year" based on the current build date which was embedded in the binary and possibly other files. A patch attached that uses SOURCE_DATE_EPOCH instead.

As a side-effect, this fixes the (accidental) reset of MATE_DATE in the Autotools build system in inherited from mate-desktop-environment.git.

This was originally filed in Debian as #951357.

@rbuj

This comment has been minimized.

Copy link
Member

rbuj commented Feb 15, 2020

It should also be done on the mate-about/meson.build file, otherwise the build won't be reproducible using meson.

Whilst working on the Reproducible Builds effort [0] we noticed that
mate-desktop could not be built reproducibly.

This is is because it generated a "release year" etc. based on the current
build date which was embedded in the binary and possibly other files. A
patch attached that uses SOURCE_DATE_EPOCH [1] instead.

As a side-effect, this fixes the (accidental) reset of MATE_DATE in the
Autotools build system in inherited from mate-desktop-environment.git.

This was originally filed in Debian as #951357 [2].

 [0] https://reproducible-builds.org/
 [1] https://reproducible-builds.org/specs/source-date-epoch/
 [2] https://bugs.debian.org/951357
@lamby lamby force-pushed the lamby:951357-mate-desktop-please-make-the-build-reproducible branch from 731b97f to 6d8dfce Feb 15, 2020
@lamby

This comment has been minimized.

Copy link
Contributor Author

lamby commented Feb 15, 2020

Sure thing; updated patch attached.

@rbuj
rbuj approved these changes Feb 15, 2020
Copy link
Member

rbuj left a comment

It looks good to me:

$  ./autogen.sh --prefix=/usr && make && sudo make install
$ mate-about
$ meson setup builddir --prefix=/usr && ninja -C builddir && sudo ninja -C builddir install
$ mate-about
@rbuj rbuj requested a review from mate-desktop/core-team Feb 15, 2020
@rbuj

This comment has been minimized.

Copy link
Member

rbuj commented Feb 16, 2020

test: Year 2038 problem PASSED

$ SOURCE_DATE_EPOCH=2147617954 ./autogen.sh --prefix=/usr && make && sudo make install
$ mate-about

Screenshot showing the year 2038:

Screenshot at 2020-02-15 19-07-01

Copy link
Member

lukefromdc left a comment

Just got a clean build with meson, and it correctly showed the year 2020 with normal clock settings in mate-about.

Note that being able to reproduce and hash-check builds in general benefits security both by allowing users to confirm builds and because of that deterring malicious persons or organizationbs from distributing builds from covertly altered source.

@rbuj rbuj merged commit 5abf684 into mate-desktop:master Feb 16, 2020
1 check passed
1 check passed
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@lamby lamby deleted the lamby:951357-mate-desktop-please-make-the-build-reproducible branch Feb 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants
You can’t perform that action at this time.