Skip to content

Draft: MkOrigtargz: Improve tarball reproducibility.

Simon Josefssonrequested to merge
jas/devscripts:mkorigtargz-reproducibility into main

The --format=ustar is better than the V7 format and is a conservative choice if we don't want to switch to PAX just yet, see discussion here: https://serverfault.com/questions/250511/which-tar-file-format-should-i-use

Using --numeric-owner --owner=0 --group=0 avoids relying on the target system having a /etc/passwd and /etc/group user/group called 'root' and that they both map to uid/gid 0 which is the intent.

Sorting filenames with --sort=name improve tarball reproducability.

Hard code permissions with --mode=go=rX,u+rw,a-s inspired by Guix.

Using --mtime and --clamp-mtime remains and is the complex part.

Merge request reports