[nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[Philipp Bartsch]

Including build timestamps in artifacts makes it harder to reproducibly
build them.

Allow to overwrite build timestamp MAKE_STAMP by setting the
SOURCE_DATE_EPOCH environment variable.

More details on SOURCE_DATE_EPOCH and reproducible builds:
https://reproducible-builds.org/docs/source-date-epoch/

Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
Reported-by: Arnout Engelen <arnout@bzzt.net>
Closes: https://github.com/NixOS/nixpkgs/issues/478048
Signed-off-by: Philipp Bartsch <phil@grmr.de>
---
 configure.ac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index dd172e88..3c672c99 100644
--- a/configure.ac
+++ b/configure.ac
@@ -165,7 +165,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
 ])
 # Current date should be fetched exactly once per build,
 # so have 'make' call date and pass the value to every 'gcc' call
-AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
+AC_SUBST([MAKE_STAMP], ["\$(shell printenv SOURCE_DATE_EPOCH || date +%s)"])
 
 AC_ARG_ENABLE([distcheck],
 	      AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
-- 
2.52.0

Re: [nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[Jeremy Sowden]

[-- Attachment #1: Type: text/plain, Size: 2023 bytes --]

On 2026-01-23, at 13:30:40 +0100, Philipp Bartsch wrote:
> Including build timestamps in artifacts makes it harder to
> reproducibly build them.
> 
> Allow to overwrite build timestamp MAKE_STAMP by setting the
> SOURCE_DATE_EPOCH environment variable.
> 
> More details on SOURCE_DATE_EPOCH and reproducible builds:
> https://reproducible-builds.org/docs/source-date-epoch/
> 
> Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
> Reported-by: Arnout Engelen <arnout@bzzt.net>
> Closes: https://github.com/NixOS/nixpkgs/issues/478048
> Signed-off-by: Philipp Bartsch <phil@grmr.de>
> ---
>  configure.ac | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/configure.ac b/configure.ac
> index dd172e88..3c672c99 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -165,7 +165,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
>  ])
>  # Current date should be fetched exactly once per build,
>  # so have 'make' call date and pass the value to every 'gcc' call
> -AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
> +AC_SUBST([MAKE_STAMP], ["\$(shell printenv SOURCE_DATE_EPOCH || date +%s)"])
> 
>  AC_ARG_ENABLE([distcheck],
>  	      AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),

Apart from the reproducibility problem, the original code doesn't actual
do what the comment says.  `date` is called every time a file is
compiled.  Here are the first and last half-dozen time-stamps snipped
from a recent build:

	-DMAKE_STAMP=1769185524
	-DMAKE_STAMP=1769185524
	-DMAKE_STAMP=1769185524
	-DMAKE_STAMP=1769185524
	-DMAKE_STAMP=1769185525
	-DMAKE_STAMP=1769185525
	...
	-DMAKE_STAMP=1769185536
	-DMAKE_STAMP=1769185536
	-DMAKE_STAMP=1769185539
	-DMAKE_STAMP=1769185539
	-DMAKE_STAMP=1769185540
	-DMAKE_STAMP=1769185540

Generating one time-stamp in the Makefile is a pain in backside.  I have
come up with a way to do it, but it's fiddly.  Florian, Phil, would it
suffice to generate the time-stamp in configure?

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 931 bytes --]

Re: [nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[Pablo Neira Ayuso]

Cc'ing Phil.

On Fri, Jan 23, 2026 at 04:36:15PM +0000, Jeremy Sowden wrote:
> On 2026-01-23, at 13:30:40 +0100, Philipp Bartsch wrote:
> > Including build timestamps in artifacts makes it harder to
> > reproducibly build them.
> > 
> > Allow to overwrite build timestamp MAKE_STAMP by setting the
> > SOURCE_DATE_EPOCH environment variable.
> > 
> > More details on SOURCE_DATE_EPOCH and reproducible builds:
> > https://reproducible-builds.org/docs/source-date-epoch/
> > 
> > Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
> > Reported-by: Arnout Engelen <arnout@bzzt.net>
> > Closes: https://github.com/NixOS/nixpkgs/issues/478048
> > Signed-off-by: Philipp Bartsch <phil@grmr.de>
> > ---
> >  configure.ac | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/configure.ac b/configure.ac
> > index dd172e88..3c672c99 100644
> > --- a/configure.ac
> > +++ b/configure.ac
> > @@ -165,7 +165,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
> >  ])
> >  # Current date should be fetched exactly once per build,
> >  # so have 'make' call date and pass the value to every 'gcc' call
> > -AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
> > +AC_SUBST([MAKE_STAMP], ["\$(shell printenv SOURCE_DATE_EPOCH || date +%s)"])
> > 
> >  AC_ARG_ENABLE([distcheck],
> >  	      AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
> 
> Apart from the reproducibility problem, the original code doesn't actual
> do what the comment says.  `date` is called every time a file is
> compiled.  Here are the first and last half-dozen time-stamps snipped
> from a recent build:
> 
> 	-DMAKE_STAMP=1769185524
> 	-DMAKE_STAMP=1769185524
> 	-DMAKE_STAMP=1769185524
> 	-DMAKE_STAMP=1769185524
> 	-DMAKE_STAMP=1769185525
> 	-DMAKE_STAMP=1769185525
> 	...
> 	-DMAKE_STAMP=1769185536
> 	-DMAKE_STAMP=1769185536
> 	-DMAKE_STAMP=1769185539
> 	-DMAKE_STAMP=1769185539
> 	-DMAKE_STAMP=1769185540
> 	-DMAKE_STAMP=1769185540
> 
> Generating one time-stamp in the Makefile is a pain in backside.  I have
> come up with a way to do it, but it's fiddly.  Florian, Phil, would it
> suffice to generate the time-stamp in configure?

Due to this issue, I can also see bogus:

# Warning: table ip x was created by a newer version of nftables? Content may be incomplete!

with partial recompilations while developing on nftables, it is a bit
annoying because I have to: make clean and compile again. This
occasionally triggers spurious tests failures here for that reason.

Re: [nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[Phil Sutter]

On Wed, Jan 28, 2026 at 03:29:54AM +0100, Pablo Neira Ayuso wrote:
> Cc'ing Phil.

Thanks!

> On Fri, Jan 23, 2026 at 04:36:15PM +0000, Jeremy Sowden wrote:
> > On 2026-01-23, at 13:30:40 +0100, Philipp Bartsch wrote:
> > > Including build timestamps in artifacts makes it harder to
> > > reproducibly build them.
> > > 
> > > Allow to overwrite build timestamp MAKE_STAMP by setting the
> > > SOURCE_DATE_EPOCH environment variable.
> > > 
> > > More details on SOURCE_DATE_EPOCH and reproducible builds:
> > > https://reproducible-builds.org/docs/source-date-epoch/
> > > 
> > > Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
> > > Reported-by: Arnout Engelen <arnout@bzzt.net>
> > > Closes: https://github.com/NixOS/nixpkgs/issues/478048
> > > Signed-off-by: Philipp Bartsch <phil@grmr.de>

Acked-by: Phil Sutter <phil@nwl.cc>

> > > ---
> > >  configure.ac | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/configure.ac b/configure.ac
> > > index dd172e88..3c672c99 100644
> > > --- a/configure.ac
> > > +++ b/configure.ac
> > > @@ -165,7 +165,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
> > >  ])
> > >  # Current date should be fetched exactly once per build,
> > >  # so have 'make' call date and pass the value to every 'gcc' call
> > > -AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
> > > +AC_SUBST([MAKE_STAMP], ["\$(shell printenv SOURCE_DATE_EPOCH || date +%s)"])
> > > 
> > >  AC_ARG_ENABLE([distcheck],
> > >  	      AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
> > 
> > Apart from the reproducibility problem, the original code doesn't actual
> > do what the comment says.  `date` is called every time a file is
> > compiled.  Here are the first and last half-dozen time-stamps snipped
> > from a recent build:
> > 
> > 	-DMAKE_STAMP=1769185524
> > 	-DMAKE_STAMP=1769185524
> > 	-DMAKE_STAMP=1769185524
> > 	-DMAKE_STAMP=1769185524
> > 	-DMAKE_STAMP=1769185525
> > 	-DMAKE_STAMP=1769185525
> > 	...
> > 	-DMAKE_STAMP=1769185536
> > 	-DMAKE_STAMP=1769185536
> > 	-DMAKE_STAMP=1769185539
> > 	-DMAKE_STAMP=1769185539
> > 	-DMAKE_STAMP=1769185540
> > 	-DMAKE_STAMP=1769185540

Ugh, that's indeed a bug.

> > Generating one time-stamp in the Makefile is a pain in backside.  I have
> > come up with a way to do it, but it's fiddly.  Florian, Phil, would it
> > suffice to generate the time-stamp in configure?

I deliberately chose a build timestamp, not a configure one. In most
cases it won't matter, but since one could defeat the stamp by
recompiling after making changes without calling configure.

> Due to this issue, I can also see bogus:
> 
> # Warning: table ip x was created by a newer version of nftables? Content may be incomplete!
> 
> with partial recompilations while developing on nftables, it is a bit
> annoying because I have to: make clean and compile again. This
> occasionally triggers spurious tests failures here for that reason.

Requesting simple expansion by assigning to MAKE_STAMP using ':='
operator fixes the value throughout one build, but partial recompiling
still leads to objects compiled with different MAKE_STAMP values.

Looks like nftbuildstamp should reside in an object file which is forced
to recompile each time. MAKE_STAMP being consumed by a single object
also mitigates the recursive expansion. WDYT? Am I missing a detail?

Thanks, Phil

Re: [nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> > > Generating one time-stamp in the Makefile is a pain in backside.  I have
> > > come up with a way to do it, but it's fiddly.  Florian, Phil, would it
> > > suffice to generate the time-stamp in configure?
> 
> I deliberately chose a build timestamp, not a configure one. In most
> cases it won't matter, but since one could defeat the stamp by
> recompiling after making changes without calling configure.

I don't think thats a concern.  This is geared towards official
releases only (and catching possible issues on update path on
real deployments, not deveopment workstation).

So I vote for configure-time.

Re: [nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[Jeremy Sowden]

[-- Attachment #1: Type: text/plain, Size: 777 bytes --]

On 2026-01-28, at 13:48:35 +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > > > Generating one time-stamp in the Makefile is a pain in backside.
> > > > I have come up with a way to do it, but it's fiddly.  Florian,
> > > > Phil, would it suffice to generate the time-stamp in configure?
> >
> > I deliberately chose a build timestamp, not a configure one. In most
> > cases it won't matter, but since one could defeat the stamp by
> > recompiling after making changes without calling configure.
> 
> I don't think thats a concern.  This is geared towards official
> releases only (and catching possible issues on update path on real
> deployments, not deveopment workstation).

This is my thinking.

> So I vote for configure-time.

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 931 bytes --]