script: Add `mtime` constant for reproducible Fedora tarball
What the developer wrote
Authored by ShahanaFarooqui
script: Add `mtime` constant for reproducible Fedora tarball
Changelog-Fixed: Fedora releases are also deterministic now.
What changed, and why it matters
This commit changes the release build script so that Fedora tarballs use a fixed timestamp when files are packed. This makes the resulting archive byte-for-byte identical every time it is built, which is a reproducible-build improvement. There is no security vulnerability here.
No security action needed. This is a benign reproducible-build improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds --mtime='@1672531200' to the tar invocation in tools/build-release.sh. This sets every file’s modification time in the tarball to a constant Unix epoch value (2023-01-01 00:00:00 UTC), eliminating a source of non-determinism in Fedora release tarballs. It is a build-hardening/reproducibility fix, not a code change affecting runtime behavior, cryptography, or network handling.
Changed components
tools/build-release.shInspect captured patch +2 / −1
diff --git a/tools/build-release.sh b/tools/build-release.sh
index 7a96a22a..35649bfc 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -18,7 +18,8 @@ if [ "$1" = "--inside-docker" ]; then
./configure
uv run make -j"$MAKEPAR" VERSION="$VER"
uv run make -j"$MAKEPAR" install DESTDIR=/"$VER-$PLTFM-$PLTFMVER-$ARCH" RUST_PROFILE=release
- cd /"$VER-$PLTFM-$PLTFMVER-$ARCH" && tar cvfz /release/clightning-"$VER-$PLTFM-$PLTFMVER-$ARCH".tar.gz -- *
+ cd /"$VER-$PLTFM-$PLTFMVER-$ARCH"
+ tar cvfz /release/clightning-"$VER-$PLTFM-$PLTFMVER-$ARCH".tar.gz --mtime='@1672531200' -- *
echo "Inside docker: build finished"
exit 0
fi
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.