Re: [PATCH 10/11] deb_add_changelog: use SOURCE_DATE_EPOCH

[Henning Schild <henning.schild@siemens.com>]

Am Wed, 11 Jan 2023 04:11:39 +0000
schrieb Felix Moessbauer <felix.moessbauer@siemens.com>:

> In case the SOURCE_DATE_EPOCH bb variable is set, use that value
> both for the auto-generated changelog as well as when appending to
> an existing changelog.
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>  meta/classes/debianize.bbclass | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/meta/classes/debianize.bbclass
> b/meta/classes/debianize.bbclass index a6694a0..3d5d934 100644
> --- a/meta/classes/debianize.bbclass
> +++ b/meta/classes/debianize.bbclass
> @@ -14,7 +14,7 @@ MAINTAINER ??= "Unknown maintainer
> <unknown@example.com>" 
>  deb_add_changelog() {
>  	changelog_v="${CHANGELOG_V}"
> -	timestamp=3600
> +	timestamp=${@ d.getVar('SOURCE_DATE_EPOCH', True) or '3600' }
>  	if [ -f ${S}/debian/changelog ]; then
>  		if [ ! -f ${WORKDIR}/changelog.orig ]; then
>  			cp ${S}/debian/changelog
> ${WORKDIR}/changelog.orig @@ -23,9 +23,11 @@ deb_add_changelog() {
>  		if [ -s ${WORKDIR}/changelog.orig ]; then
>  			orig_version=$(dpkg-parsechangelog -l
> ${WORKDIR}/changelog.orig -S Version) changelog_v=$(echo
> "${changelog_v}" | sed 's/<orig-version>/'${orig_version}'/')
> -			orig_date=$(dpkg-parsechangelog -l
> ${WORKDIR}/changelog.orig -S Date)
> -			orig_seconds=$(date --date="${orig_date}"
> +'%s')
> -			timestamp=$(expr ${orig_seconds} + 42)
> +			if [ -z "${SOURCE_DATE_EPOCH}" ]; then
> +				orig_date=$(dpkg-parsechangelog -l
> ${WORKDIR}/changelog.orig -S Date)
> +				orig_seconds=$(date
> --date="${orig_date}" +'%s')
> +				timestamp=$(expr ${orig_seconds} +
> 42)

What would happen if we prepended an entry older than orig-date? I hope
this would trigger some sort of warning or maybe even package build
failure.

I still think the images SOURCE_DATE_EPOCH should not be used for
individual components. The value of doing so remains unclear, while it
is very risky to use global scope variables to construct package
content. Correct me if i am wrong, but without this patch everything
will be reproducible just fine.

Henning

> +			fi
>  		fi
>  	fi
>