dpkg-deb: Set ar timestamp and tar mtime clamping to SOURCE_DATE_EPOCH

The ar and tar file entries contain a timestamp which is usually filled
with the current build time and the file mtime respectively. This causes
the generated deb(5) packages to not be reproducible for the same source
package and same build environment.

We now check if the environment variable SOURCE_DATE_EPOCH is defined,
parse that and use it as the timestamp for ar and to clamp the mtime in
the tar file entries.

This variable is specified to contain the timestamp of the source
release date in seconds since the epoch.

Closes: #759999
Base-on-patch-by: Jérémy Bobbio <lunar@debian.org>

debian/changelog

@@ -31,6 +31,9 @@ dpkg (1.18.8) UNRELEASED; urgency=medium
     binary packages has an mtime later than the given time. Closes: #759886
   * Use the same timestamp for the ar container as for tarball mtime clamping
     in dpkg-deb.
+  * Set ar timestamp and tar mtime clamping to SOURCE_DATE_EPOCH if defined
+    in dpkg-deb. Base on a patch by Jérémy Bobbio <lunar@debian.org>.
+    Closes: #759999
   * Perl modules:
     - Use warnings::warnif() instead of carp() for deprecated warnings.
     - Add new format_range() method and deprecate dpkg() and rfc822() methods

dpkg-deb/build.c

@@ -474,6 +474,20 @@ tarball_pack(const char *dir, filenames_feed_func *tar_filenames_feeder,
   subproc_reap(pid_tar, "tar -cf", 0);
 }
 
+static time_t
+parse_timestamp(const char *value)
+{
+  time_t timestamp;
+  char *end;
+
+  errno = 0;
+  timestamp = strtol(value, &end, 10);
+  if (value == end || *end || errno != 0)
+    ohshite(_("unable to parse timestamp '%.255s'"), value);
+
+  return timestamp;
+}
+
 /**
  * Overly complex function that builds a .deb file.
  */
@@ -484,6 +498,7 @@ do_build(const char *const *argv)
   struct dpkg_error err;
   struct dpkg_ar *ar;
   time_t timestamp;
+  const char *timestamp_str;
   const char *dir, *dest;
   char *ctrldir;
   char *debar;
@@ -518,7 +533,11 @@ do_build(const char *const *argv)
   }
   m_output(stdout, _("<standard output>"));
 
-  timestamp = time(NULL);
+  timestamp_str = getenv("SOURCE_DATE_EPOCH");
+  if (timestamp_str)
+    timestamp = parse_timestamp(timestamp_str);
+  else
+    timestamp = time(NULL);
 
   /* Now that we have verified everything its time to actually
    * build something. Let's start by making the ar-wrapper. */

man/dpkg-deb.1

@@ -304,6 +304,11 @@ memory allocations, etc.
 .B TMPDIR
 If set, \fBdpkg\-deb\fP will use it as the directory in which to create
 temporary files and directories.
+.TP
+.B SOURCE_DATE_EPOCH
+If set, it will be used as the timestamp (as seconds since the epoch) in
+the \fBdeb\fP(5)'s \fBar\fB(5) container and used to clamp the mtime in
+the \fBtar\fB(5) file entries.
 .
 .SH NOTES
 Do not attempt to use just