Please add a way for clients to set the creation date/time in profile headers

[thomas-weber]

Hi, this is Debian bug 814883, https://bugs.debian.org/814883
Debian is trying to move to reproducible builds (https://wiki.debian.org/ReproducibleBuilds), that is the ability to reproduce byte-identical packages.

lcms is currently always using the current time to set the creation time in profile headers. The attached patch adds a function cmsSetHeaderCreationDateTime() that allows clients to set an explicit creation date/time.
add_set_header_creation_date_time.patch.txt

[mm2]

This goes against this field purpose, which is to create always unique profiles. If you really need that, please consider to access the header directly, this is the reason the header structure is available in lcms2.h API.

[h01ger]

do you maybe have changed your mind on this? I'd be glad to explain furthe…!

[mm2]

This is very simple actually:

cmsICCHeader h;

fread(&h, sizeof(cmsICCHeader), 1, stream);
_cmsEncodeDateTimeNumber(&h.date, yourdatetime);
fseek(stream, 0, SEEK_SET);
fwrite(&h, sizeof(cmsICCHeader), 1, stream);

[RAOF]

@mm2 Correct me if I'm wrong, but I think that would require a recalculation of the profile ID MD5?

So the full workflow would be

• Write out ICC file with cmsSaveProfileToMem,
• _cmsEncodeDataTimeNumber on the output ICC buffer,
• cmsOpenProfileFromMemTHR on the modified buffer,
• cmsMD5ComputeId on the re-loaded profile
• Write out the new profile with cmsSaveProfileToMem again.

Am I right? That seems like quite a lot of work to replace a simple cmsSetHeaderCreationDateTime() function on the profile.

[hughsie]

Can we please have a cmsSetHeaderCreationDateTime()? The code in colord is so much more complicated to work around such a simple addition. I'm happy to write the lcms tests if required.

[beku]

I second @mm2. Generally it should not be easy to fake time stamps. Cheating on that would burden new opportunities of irritation to many end users, for a little gain of convenience of few developers.

(That does not question the usefulness of reproducible builds. That goal could be achieved inside the affected projects?)

[etrinh]

@mm2 @beku, Right, faking time stamps must not be done by littlecms by itself, but it doesn't justify by itself that it shouldn't be proposed as part of the API, as well as many other functions which may create irritation to many end users (like changing/spoofing profile name, but it is part of the API right?).
Datetime is not a security restriction (workarounds are easy as Marti and Thomas noticed).
Anyway, this purpose is hard to achieve, and maybe better to give the responsibility to the developer, don't worry, many of them know what they are doing, and others, anyway they don't care, they have bunch of easy and more or less dirty workarounds from patching icc files to lcms...
Difference is, making bad use of the API is not responsibility of the API, but the developer.