RFC: Sort tarballs created by the src-release.sh script

[Sam James]

> On 30 Sep 2022, at 12:38, Nick Clifton via Binutils <binutils@sourceware.org> wrote:
> 
> Hi Guys,
> 
>  Right, here is the latest and greatest - and hopefully last - version
>  of the patch.  I added a parseable string to the --mtime option and a
>  comment explaining why these options are being used.
> 
>  Any more comments/suggestions ?
> 
> Cheers
>  Nick
> 
> diff --git a/src-release.sh b/src-release.sh
> index 079b545ae7c..8a2ac125030 100755
> --- a/src-release.sh
> +++ b/src-release.sh
> @@ -184,9 +184,11 @@ do_tar()
>     ver=$2
>     echo "==> Making $package-$ver.tar"
>     rm -f $package-$ver.tar
> +    # The sort command and --mtime, --group and --owner options are
> +    # used in order to create consistent, reproducible tarballs.
>     find $package-$ver -follow \( $CVS_NAMES \) -prune \
> -       -o -type f -print \
> -       | tar cTfh - $package-$ver.tar
> +       -o -type f -print | LC_ALL=C sort \
> +       | tar cTfh - $package-$ver.tar --mtime="1970-01-01 00:00:00" --group=0 --owner=0
> }
> 
> # Compress the output with bzip2
> 

I think this might hit a problem I faced when trying to do this with Go tarballs: https://www.gnu.org/software/tar/manual/tar.html#warnings.

With that date, I got "implausibly old time stamp" warnings from tar. I haven't tested this patchthough (writing from mobile, apologies).

Maybe default to the creation date of Binutils and allow overriding via https://reproducible-builds.org/docs/source-date-epoch/?

best,
sam