Hello all, Thank you all for your replies so far.
On 19/09/2022 16:41, Mattia Rizzolo wrote:
On Sun, Sep 18, 2022 at 10:58:37AM +0200, Roland Clobus wrote:All of these timestamps (for sid) are close to each other, but not identical. I would guess that the earliest timestamp is the 'real' timestamp, but it is accessible (on snapshot.d.o) only with a later timestamp.Consider that the archive "freezes" when it starts working on an update. Once it finishes its job it generates the Release files, and puts the current timestamp *inside* the file. But then that file gets copied around, signed, etc and that will change the timestamp.
So if the archive is frozen when it starts to work on an update, that moment sounds to me as 'the' timestamp of the archive. Change Request: Could that timestamp be preserved and used for the timestamp inside the (In)Release file, instead of using 'now' (which is slightly later) when generating the (In)Release file?
Also, for example, I just spotted a line on IRC saying that this time around copying the archive from the live one to archive.debian.org also reset the mtimes...
In the live-build scripts, I reset the mtime of such generated files to have them match their content.
So I really wouldn't trust mtimes in any way, only what's inside the Release file.
Ack.
What's in the trace file is IIRC the time when the archive kicks the mirrors off, which also happens after the generation of the indexes, and really has no business in this discussion as it's only a tool mirrors use to coordinate and see if they are too much out of sync.
The trace file is currently used in the live-build scripts, but I'll change that to use (In)Release instead.
As you noticed snapshots indexes by time of the archive run, which is… honestly I don't particularly consider it a good idea myself but that's how the design decision went I guess.
The timestamps of snapshot.d.o are the only timestamps that I currently know that allow me to re-generate older images. Change Request: Could the use the timestamp from (In)Release instead of 'now' as well?
As to the origin of my question:The snapshot-mirror has been offline for a while, and I've used deb.debian.org to generate my test images (for the reproducible live-build-based live-ISO images). I've compared the timestamps of the InRelease file at deb.d.o with the timestamp in the URL available on snapshot.d.o and I've noticed a difference. That means that all images that I've generated using deb.d.o cannot be verified at any later moment than within the same dak-round (which last for 6 hours). Now that the snapshot-mirror is online again, I'll use that timestamp again, and thus I'll be able to generate the same image from any required timestamp. So effectively 'the' timestamp is found in the URL of snapshot.d.o, but I would like to have that one identical to the timestamp of InRelease.
With kind regards, Roland ClobusPS: Regarding these change requests: I could write some patches, but I'm still busy getting the reproducible live-images onto the automated testing platform and after confirmation of their proper functioning on the official Debian download pages (so it will take some time, before I can work on that. If anyone would be faster than I would be: thanks in advance)
OpenPGP_signature
Description: OpenPGP digital signature
