Skip to content

stdlib: Use SOURCE_DATE_EPOCH for in-memory zip entries - #11394

Open
bmwiedemann wants to merge 1 commit into
erlang:masterfrom
bmwiedemann:reproduciblezip
Open

stdlib: Use SOURCE_DATE_EPOCH for in-memory zip entries#11394
bmwiedemann wants to merge 1 commit into
erlang:masterfrom
bmwiedemann:reproduciblezip

Conversation

@bmwiedemann

Copy link
Copy Markdown
Contributor

zip:create/2,3 stamps entries created from in-memory binaries with the current local time. This makes every archive built from binaries, in particular escripts created by escript:create/2 and Elixir's mix escript.build (e.g. the rabbitmq-server escripts), unreproducible. Honor SOURCE_DATE_EPOCH when set.

See https://reproducible-builds.org/ for why this is good and https://reproducible-builds.org/specs/source-date-epoch/ for the definition of this variable.

Helps with issue #4417

This patch was done while working on reproducible builds for openSUSE.

zip:create/2,3 stamps entries created from in-memory binaries with the
current local time. This makes every archive built from binaries, in
particular escripts created by escript:create/2 and Elixir's
mix escript.build (e.g. the rabbitmq-server escripts), unreproducible.
Honor SOURCE_DATE_EPOCH when set.

See https://reproducible-builds.org/ for why this is good
and https://reproducible-builds.org/specs/source-date-epoch/
for the definition of this variable.

Helps with issue erlang#4417

This patch was done while working on reproducible builds for openSUSE.
@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

CT Test Results

    2 files    100 suites   1h 6m 57s ⏱️
2 307 tests 2 255 ✅ 52 💤 0 ❌
2 726 runs  2 670 ✅ 56 💤 0 ❌

Results for commit 13da01c.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

@jhogberg

jhogberg commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Thanks for the PR!

However, zip:create/2,3 (and by extension escript:create/2) does not work as you describe. If you provide a #file_info{} for each file then that will be used. It would be better to pass SOURCE_DATE_EPOCH on a per-file basis than to implicitly read it within the zip module.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

team:VM Assigned to OTP team VM

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants