Hello Vagrant, list, On 19/01/2026 21:07, Vagrant Cascadian wrote:
On 2026-01-08, Roland Clobus wrote:Recently I've started to look again at snapshot.debian.org as an alternative source for generating live images. I've adjusted the building script to make the images between builds as similar as possible, but now there 'only' some timestamps left.These timestamps are from .deb packages, which are downloaded with the --timestamping option enabled. However, the timestamps differ between deb.debian.org and snapshot.debian.org for files with the same content....Should I normalise the timestamp of the .deb files to the timestamp of data.tar.xz, while builing the live images? Or should this be solved 'upstream' in the Debian archive/snapshot archive to preserve/set the timestamps of the .deb files?Normalizing the snapshot and "master" archive might be nice, but obviously requires more coordination...
I've found the source code for snapshot.debian.org: https://salsa.debian.org/snapshot-team/snapshot Bug #1126000 has been created, that would cover the different timestamps between both archives. That would solve the differences I've seen.
Normalizing the timestamp of the file itself to the embedded timestamp within the .deb seems fairly reasonable... out of curiosity, does it correspond to SOURCE_DATE_EPOCH of the package build? e.g. for debian packages that should be the same as the debian/changelog timestamp, and thus essentially deterministic...
Indeed. Ideally, the timestamp of the files on deb.debian.org would reflect the value of SOURCE_DATE_EPOCH during the creation of the package, which is the debian/changelog timestamp. However, there are more files that would need to carry the same timestamp: the .dsc and .tar.xz files. Meanwhile I can normalise the timestamps. Would that be something to be integrated into `strip-nondeterminism` or `add-determinism`? (Or just in `live-build`) With kind regards, Roland Clobus
OpenPGP_signature.asc
Description: OpenPGP digital signature
