Re: [nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[Pablo Neira Ayuso <pablo@netfilter.org>]

Cc'ing Phil.

On Fri, Jan 23, 2026 at 04:36:15PM +0000, Jeremy Sowden wrote:
> On 2026-01-23, at 13:30:40 +0100, Philipp Bartsch wrote:
> > Including build timestamps in artifacts makes it harder to
> > reproducibly build them.
> > 
> > Allow to overwrite build timestamp MAKE_STAMP by setting the
> > SOURCE_DATE_EPOCH environment variable.
> > 
> > More details on SOURCE_DATE_EPOCH and reproducible builds:
> > https://reproducible-builds.org/docs/source-date-epoch/
> > 
> > Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
> > Reported-by: Arnout Engelen <arnout@bzzt.net>
> > Closes: https://github.com/NixOS/nixpkgs/issues/478048
> > Signed-off-by: Philipp Bartsch <phil@grmr.de>
> > ---
> >  configure.ac | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/configure.ac b/configure.ac
> > index dd172e88..3c672c99 100644
> > --- a/configure.ac
> > +++ b/configure.ac
> > @@ -165,7 +165,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
> >  ])
> >  # Current date should be fetched exactly once per build,
> >  # so have 'make' call date and pass the value to every 'gcc' call
> > -AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
> > +AC_SUBST([MAKE_STAMP], ["\$(shell printenv SOURCE_DATE_EPOCH || date +%s)"])
> > 
> >  AC_ARG_ENABLE([distcheck],
> >  	      AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
> 
> Apart from the reproducibility problem, the original code doesn't actual
> do what the comment says.  `date` is called every time a file is
> compiled.  Here are the first and last half-dozen time-stamps snipped
> from a recent build:
> 
> 	-DMAKE_STAMP=1769185524
> 	-DMAKE_STAMP=1769185524
> 	-DMAKE_STAMP=1769185524
> 	-DMAKE_STAMP=1769185524
> 	-DMAKE_STAMP=1769185525
> 	-DMAKE_STAMP=1769185525
> 	...
> 	-DMAKE_STAMP=1769185536
> 	-DMAKE_STAMP=1769185536
> 	-DMAKE_STAMP=1769185539
> 	-DMAKE_STAMP=1769185539
> 	-DMAKE_STAMP=1769185540
> 	-DMAKE_STAMP=1769185540
> 
> Generating one time-stamp in the Makefile is a pain in backside.  I have
> come up with a way to do it, but it's fiddly.  Florian, Phil, would it
> suffice to generate the time-stamp in configure?

Due to this issue, I can also see bogus:

# Warning: table ip x was created by a newer version of nftables? Content may be incomplete!

with partial recompilations while developing on nftables, it is a bit
annoying because I have to: make clean and compile again. This
occasionally triggers spurious tests failures here for that reason.