Do the file timestamps in ISOs matter ?

["Thomas Schmitt" <scdbackup@gmx.net>]

Hi,

do the file timestamps matter in ISOs of debian-cd, debian-live,
or in other Debian ISOs ?

I ask this because xorriso-1.4.6 will obey environment variable
  SOURCE_DATE_EPOCH
of reproducible-builds. I then plan to propose to debian ISO producers to
use xorriso-1.4.6 with new original ISOs and to do the equivalent of shell
command
  export SOURCE_DATE_EPOCH=$(date '+%s')
before running xorriso.


It is decided that SOURCE_DATE_EPOCH will override the defaults of the
volume timestamps and of some id data which normally get derived from
the time of the ISO production.
xorrisofs options like --modification-date= will still be able to
override the default set by SOURCE_DATE_EPOCH.

Still undecided is whether it shall by default override all timestamps
inside the ISO, or whether it shall only copy each file's mtime to the
same file's ctime and atime (to ease reproduction of input file trees).

Obviously there are three ideas of reproducible ISO content:
- All three file timestamps do matter.
- mtime does matter. atime and ctime are harder to influence in the
  input tree and thus should get overwritten by mtime.
- File timestamps do not matter. After all, the files all got copied
  from some disk tree into the ISO at the same time.

xorriso will support all three models by allowing to override SOURCE_DATE_EPOCH
by one of three parameters to a new program option:
  --set_all_file_dates  default
  --set_all_file_dates  set_to_mtime
  --set_all_file_dates  ="$SOURCE_DATE_EPOCH"

(The latter depends on shell variable evaluation. "=" tells xorriso
 that the date value is seconds since 1970. xorriso wants to see a
 number like 1472115709 then.)

All affected producers of Debian ISOs and reproducible-builds are invited
to discuss and decide what default to choose from SOURCE_DATE_EPOCH.


Have a nice day :)

Thomas