Hello Philipp, On 21/01/2026 11:30, Philipp Kern wrote:
On 1/20/26 9:19 AM, Roland Clobus wrote:While trying to reproduce the official live images of Debian, I've noticed that the timestamp of .deb files differ between deb.debian.org and snapshot.debian.org [1].An example: (Downloaded with wcurl, then: TZ="Z" ls --time-style=+%s -l) https://deb.debian.org/debian/pool/main/h/hwdata/pnp.ids_0.394-1_all.deb 1743744651 https://snapshot.debian.org/archive/debian/20251231T202918Z/pool/main/h/ hwdata/pnp.ids_0.394-1_all.deb 1743756392 I've found the code on Salsa [2], but don't know where to start looking to prepare a fix.That's probably very hard to fix. We don't keep the timestamps as far as I know and the first seen timestamp is when we created the file in the pool. The redirect you get directs the web server to fetch the file from the filesystem and that is attaching the timestamp to the download. We could in theory scrub the timestamp there but that would not be helpful either.
When the file is created for the pool: that would be the ideal moment to adjust the timestamp. Where in the code does that happen? I assume that at that moment the origin is still known, so the timestamp can be deducted from there.
I think the answer should be to compare under scrubbing of timestamps on your side, unfortunately. I assume we already do that in other cases.
I'll pursue that strategy as well. With kind regards, Roland Clobus
OpenPGP_signature.asc
Description: OpenPGP digital signature
