Bug#1104854: binNMUs can cause ma-same violations in eg manpages
Simon Josefsson <simon@josefsson.org> writes:
> My take is that it is a bug to use SOURCE_DATE_EPOCH to populate the
> timestamp inside a man page. This is just one of many symptoms that will
> arise from trying to use SOURCE_DATE_EPOCH in an upstream context.
> It seems generally better if upstream derive timestamps inside artifacts
> from the source code for that artifact, or the last upstream release if
> tracking the source code is problematic. Then these timestamps will be
> stable during all future rebuilds of the same artifact.
I am the maintainer of one of the main documentation generation tools that
does this (pod2man). I used to do it the way that you prefer and changed
to SOURCE_DATE_EPOCH to fix reproducibility problems at the request of the
reproducible-builds team.
I'm happy to try to address this problem in the generator, but this is the
opposite of the direction in which I thought we were going, so I want to
really understand the shape of the problem before making more changes. In
particular, what "timestamp inside artifacts from the source code" do you
believe I should use? I do not have any special access to the upstream
release date. Or is the argument that the upstream build system should
explicitly pass the date for all man pages to pod2man? This is at least
theoretically possible but is often not that straightforward depending on
the details of the build system (there are a *lot* of different build
systems in play), and I'm not sure how realistic it would be to push that
change out across all packages (which is why I tried to solve the problem
in pod2man in the first place).
--
Russ Allbery (rra@debian.org) <https://www.eyrie.org/~eagle/>
Reply to: