[issue38727] setup.py sdist --format=gztar should use (equivalent of) `gzip -n`

[Steve Dower]

Steve Dower  added the comment:

Distutils is now deprecated (see PEP 632) and all tagged issues are being 
closed. From now until removal, only release blocking issues will be considered 
for distutils.

If this issue does not relate to distutils, please remove the component and 
reopen it. If you believe it still requires a fix, most likely the issue should 
be re-reported at https://github.com/pypa/setuptools

--
nosy: +steve.dower
resolution:  -> out of date
stage:  -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue38727] setup.py sdist --format=gztar should use (equivalent of) `gzip -n`

[Éric Araujo]

Éric Araujo  added the comment:

setuptools has its own copy of distutils now.

flit is independent of distutils.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue38727] setup.py sdist --format=gztar should use (equivalent of) `gzip -n`

[Zack Weinberg]

Zack Weinberg  added the comment:

The code that needs to be changed is in distutils, setuptools just calls into 
it. I haven't checked flit but I expect it does the same.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue38727] setup.py sdist --format=gztar should use (equivalent of) `gzip -n`

[Éric Araujo]

Éric Araujo  added the comment:

Distutils isn’t used much (directly), I think this should be reported to the 
tools that create sdists, such as setuptools and flit.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue38727] setup.py sdist --format=gztar should use (equivalent of) `gzip -n`

[Zack Weinberg]

New submission from Zack Weinberg :

Recent versions of the gzip command-line utility have an option `-n` which 
causes it to omit the FNAME field of the gzip file header, and write out the 
MTIME field as zero.  Both of these properties are desirable when constructing 
reproducible build artifacts (see https://reproducible-builds.org/ ).

An sdist tarball is a build artifact and it should be created as reproducibly 
as possible.  In particular, --format=gztar should behave as-if `gzip -n` were 
in use.  (The stdlib's gzip module can produce output equivalent to what gzip 
-n does, but this is not currently documented nor is it accessible via 
`tarfile`.  Both of those should be easy fixes.  See bug 38725 and bug 38726.)

--
components: Distutils
messages: 356152
nosy: dstufft, eric.araujo, zwol
priority: normal
severity: normal
status: open
title: setup.py sdist --format=gztar should use (equivalent of) `gzip -n`

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com