From 352fd90e5124a6fbcfbb1763082de1980c4333e5 Mon Sep 17 00:00:00 2001
From: Olof Johansson <olof@ethup.se>
Date: Sat, 30 May 2015 01:54:55 +0200
Subject: [PATCH] build: Truncate timestamps in zip archive

Even though zip's -X flag suggests that it removes timestamps, that's not
quite true. There's still modification times per file, and that introduces
non-determinism that are hard to notice, since the mtimes are unlikely to
change without changes to the files. Only when doing a new clone/unpacking
a tar ball under some circumstances or similar action that resets/discards
the mtimes, we would notice.

So, the -X is not enough, and from what I can tell, there's no way of
telling zip to not include timestamps (or truncate them). With this
change, we stage all files in a temporary .build directory, and set the
mtime manually to the beginning of time (as is the case for zip files:
1980-01-01T00:00). These timestamps should not be important to anyone,
since they are all presented to the user as a blob.

The rationale for this change is that this makes it possible to build
svtplay-dl reproducibly. And it also removes the pesky svtplay-dl diffs
just from regenerating the executable.
---
 lib/Makefile | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/lib/Makefile b/lib/Makefile
index 1b4220f..c9c43f4 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -14,14 +14,28 @@ export PACKAGES = svtplay_dl \
                  svtplay_dl.utils \
                  svtplay_dl.service \
                  svtplay_dl.subtitle
-export PYFILES = $(addsuffix /*.py,$(subst .,/,$(PACKAGES)))
+export PYFILES = $(sort $(addsuffix /*.py,$(subst .,/,$(PACKAGES))))
 
 PYTHON ?= /usr/bin/env python
 
 svtplay-dl: $(PYFILES)
-	zip -X --quiet svtplay-dl $(PYFILES)
-	zip -X --quiet --junk-paths svtplay-dl svtplay_dl/__main__.py
+	@# Verify that there's no .build already \
+	! [ -d .build ] || { \
+		echo "ERROR: build already in progress? (or remove $(PWD)/.build/)"; \
+		exit 1; \
+	}; \
+	mkdir -p .build
+
+	@# Stage the files in .build for postprocessing
+	for py in $(PYFILES); do install -D $$py .build/$$py; done
+
+	@# reset timestamps, to avoid non-determinism in zip file
+	find .build/ -exec touch -m -t 198001010000 {} \;
+
+	(cd .build && zip -X --quiet svtplay-dl $(PYFILES))
+	(cd .build && zip -X --quiet --junk-paths svtplay-dl svtplay_dl/__main__.py)
+
 	echo '#!$(PYTHON)' > svtplay-dl
-	cat svtplay-dl.zip >> svtplay-dl
-	rm svtplay-dl.zip
+	cat .build/svtplay-dl.zip >> svtplay-dl
+	rm -rf .build
 	chmod a+x svtplay-dl