Building live images from snapshot.d.o

[Roland Clobus]

Hello Vagrant, list,

On 19/01/2026 21:07, Vagrant Cascadian wrote:
> On 2026-01-08, Roland Clobus wrote:
>> Recently I've started to look again at snapshot.debian.org as an
>> alternative source for generating live images. I've adjusted the
>> building script to make the images between builds as similar as
>> possible, but now there 'only' some timestamps left.
>>
>> These timestamps are from .deb packages, which are downloaded with the
>> --timestamping option enabled.
>> However, the timestamps differ between deb.debian.org and
>> snapshot.debian.org for files with the same content.
> ...
>> Should I normalise the timestamp of the .deb files to the timestamp of
>> data.tar.xz, while builing the live images?
>> Or should this be solved 'upstream' in the Debian archive/snapshot
>> archive to preserve/set the timestamps of the .deb files?
> 
> Normalizing the snapshot and "master" archive might be nice, but
> obviously requires more coordination...

I've found the source code for snapshot.debian.org:
https://salsa.debian.org/snapshot-team/snapshot

Bug #1126000 has been created, that would cover the different timestamps between both archives.
That would solve the differences I've seen.

> Normalizing the timestamp of the file itself to the embedded timestamp
> within the .deb seems fairly reasonable... out of curiosity, does it
> correspond to SOURCE_DATE_EPOCH of the package build? e.g. for debian
> packages that should be the same as the debian/changelog timestamp, and
> thus essentially deterministic...

Indeed. Ideally, the timestamp of the files on deb.debian.org would reflect the value of SOURCE_DATE_EPOCH during the creation of the package, which is the debian/changelog timestamp. However, there are more files that would need to carry the same timestamp: the .dsc and .tar.xz files.

Meanwhile I can normalise the timestamps. Would that be something to be integrated into `strip-nondeterminism` or `add-determinism`? (Or just in `live-build`)

With kind regards,
Roland Clobus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20260120/4e7e5dc7/attachment-0001.sig>