Determinism on installed packages

Posted Apr 11, 2025 23:18 UTC (Fri) by zuki (subscriber, #41808)
In reply to: Determinism on installed packages by jcpunk
Parent article: Fedora change aims for 99% package reproducibility

> However, if your package contains any symlinks, the mtime on the symlink is set to the timestamp when the archive is unpacked, whereas the binaries have the mtime of their compilation.

This does not seem to match what I see on Fedora. Maybe rpm gets this right?

$ ls -l /usr/bin/udevadm /usr/lib/systemd/systemd-udevd
-rwxr-xr-x 1 root root 644040 Mar 7 01:00 /usr/bin/udevadm
lrwxrwxrwx 1 root root 17 Mar 7 01:00 /usr/lib/systemd/systemd-udevd -> ../../bin/udevadm
$ rpm -q --changelog systemd|head -n1
* Fri Mar 07 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 257.4-3

As you can see, the package was built Mar 7, and this means the timestamp of 00:00:00 UTC, which is 01:00:00 CET, which is my timezone. Fedora sets SOURCE_DATE_EPOCH from that changelog timestamp, and the mtimes of files in the package are clamped to that.