Req #69727 [Opn->Csd]: Remove timestamps from build to make it reproducible

Edit report at https://bugs.php.net/bug.php?id=69727&edit=1 ID: 69727 Updated by: nikic@php.net Reported by: thijs at debian dot org Summary: Remove timestamps from build to make it reproducible -Status: Open +Status: Closed Type: Feature/Change Request Package: Unknown/Other Function PHP Version: 5.6.9 Block user comment: N Private report: N New Comment: Automatic comment on behalf of jelle@vdwaa.nl Revision: http://git.php.net/?p=php-src.git;a=commit;h=8a179fa02b50685fba47e7d19af922b07791d616 Log: Fix bug #69727: Support SOURCE_DATE_EPOCH for Build Date Previous Comments: ------------------------------------------------------------------------ [2015-09-16 16:16:50] levim@php.net To your knowledge is there anything else that prevents reproducible builds for PHP? ------------------------------------------------------------------------ [2015-05-29 08:19:28] thijs at debian dot org Description: ------------ The PHP build embeds timestamps into the generated binaries at build time. This makes the build not reproducible, as in that the same source code will not generate the bitwise exact same binaries. Reproducible builds are important amongst others to verify the integrity of distributions. See: https://wiki.debian.org/ReproducibleBuilds We believe the value of the embedded timestamps is very limited. They do not indicate which release, commit or git branch has been built, only a date which in itself does not really say something. Therefore it seems safe to remove them. Test script: --------------- https://reproducible.debian.net/rb-pkg/unstable/amd64/php5.html Expected result: ---------------- Building PHP two times yields bitwise identical binaries. Actual result: -------------- Building PHP two times yields bitwise different binaries. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69727&edit=1