On 1/22/26 2:30 PM, Roland Clobus wrote:
On 21/01/2026 11:30, Philipp Kern wrote:
On 1/20/26 9:19 AM, Roland Clobus wrote:
While trying to reproduce the official live images of Debian, I've
noticed that the timestamp of .deb files differ between
deb.debian.org and snapshot.debian.org [1].
An example: (Downloaded with wcurl, then: TZ="Z" ls --time-style=+%s -l)
https://deb.debian.org/debian/pool/main/h/hwdata/pnp.ids_0.394-1_all.deb
1743744651
https://snapshot.debian.org/archive/debian/20251231T202918Z/pool/
main/h/ hwdata/pnp.ids_0.394-1_all.deb
1743756392
I've found the code on Salsa [2], but don't know where to start
looking to prepare a fix.
That's probably very hard to fix. We don't keep the timestamps as far
as I know and the first seen timestamp is when we created the file in
the pool. The redirect you get directs the web server to fetch the
file from the filesystem and that is attaching the timestamp to the
download. We could in theory scrub the timestamp there but that would
not be helpful either.
When the file is created for the pool: that would be the ideal moment to
adjust the timestamp. Where in the code does that happen?
If it's created on security-master first, it will get a different
timestamp on ftp-master later on. I don't think that's a universally
winning strategy either.
Kind regards
Philipp Kern
