Reproducible packages on macOS, Windows (and also Linux)

[Clemens Lang]

Hi Nichita,

On Wed, Jul 03, 2024 at 10:40:17AM +0300, Nichita Morcotilo wrote:
> The second reason is that we've been semi-successful with Apple. It
> seems that a number of tools from the Apple ecosystem are not aware of
> `SOURCE_DATE_EPOCH` but instead use `ZERO_AR_DATE`. We're wondering if
> someone else is working on reproducing binary packages on macOS? The
> downside of ZERO_AR_DATE is that it zeroes out the timestamp, while
> SOURCE_DATE_EPOCH can use some "reasonable, but deterministic"
> timestamp (which we would prefer).

Last time I looked at it, one of the issues on macOS was also that the
linker did include the paths of the object files being linked in the
binary, or at least used the path to compute a hash that influenced the
build results. This wouldn't be a huge problem if the compiler didn't
place intermediate object files in a temporary directory, which made
those paths unpredictable.

It was a few years ago when I looked into this, though, so maybe it has
been fixed in the meantime.


> We did send one PR to a fork of Apple's tools to add SOURCE_DATE_EPOCH
> ( https://github.com/tpoechtrager/cctools-port/pull/140), but there
> are a few more places in `cctools` that need fixing and ideally this
> would go upstream to Apple.
> 
> Any chance someone knows someone that knows someone etc?! :)

Your best bet is probably to file a bug at
https://developer.apple.com/bug-reporting/. A different potential path
is suggested in a pull request opened in Apple's open source mirror of
cctools at https://github.com/opensource-apple/cctools/pull/1; maybe
it's worth trying to mail to opensource at apple.com.

-- 
Clemens