Re: [nftables PATCH] build: support SOURCE_DATE_EPOCH for reproducible build

[Phil Sutter <phil@nwl.cc>]

On Wed, Jan 28, 2026 at 03:29:54AM +0100, Pablo Neira Ayuso wrote:
> Cc'ing Phil.

Thanks!

> On Fri, Jan 23, 2026 at 04:36:15PM +0000, Jeremy Sowden wrote:
> > On 2026-01-23, at 13:30:40 +0100, Philipp Bartsch wrote:
> > > Including build timestamps in artifacts makes it harder to
> > > reproducibly build them.
> > > 
> > > Allow to overwrite build timestamp MAKE_STAMP by setting the
> > > SOURCE_DATE_EPOCH environment variable.
> > > 
> > > More details on SOURCE_DATE_EPOCH and reproducible builds:
> > > https://reproducible-builds.org/docs/source-date-epoch/
> > > 
> > > Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
> > > Reported-by: Arnout Engelen <arnout@bzzt.net>
> > > Closes: https://github.com/NixOS/nixpkgs/issues/478048
> > > Signed-off-by: Philipp Bartsch <phil@grmr.de>

Acked-by: Phil Sutter <phil@nwl.cc>

> > > ---
> > >  configure.ac | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/configure.ac b/configure.ac
> > > index dd172e88..3c672c99 100644
> > > --- a/configure.ac
> > > +++ b/configure.ac
> > > @@ -165,7 +165,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
> > >  ])
> > >  # Current date should be fetched exactly once per build,
> > >  # so have 'make' call date and pass the value to every 'gcc' call
> > > -AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
> > > +AC_SUBST([MAKE_STAMP], ["\$(shell printenv SOURCE_DATE_EPOCH || date +%s)"])
> > > 
> > >  AC_ARG_ENABLE([distcheck],
> > >  	      AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
> > 
> > Apart from the reproducibility problem, the original code doesn't actual
> > do what the comment says.  `date` is called every time a file is
> > compiled.  Here are the first and last half-dozen time-stamps snipped
> > from a recent build:
> > 
> > 	-DMAKE_STAMP=1769185524
> > 	-DMAKE_STAMP=1769185524
> > 	-DMAKE_STAMP=1769185524
> > 	-DMAKE_STAMP=1769185524
> > 	-DMAKE_STAMP=1769185525
> > 	-DMAKE_STAMP=1769185525
> > 	...
> > 	-DMAKE_STAMP=1769185536
> > 	-DMAKE_STAMP=1769185536
> > 	-DMAKE_STAMP=1769185539
> > 	-DMAKE_STAMP=1769185539
> > 	-DMAKE_STAMP=1769185540
> > 	-DMAKE_STAMP=1769185540

Ugh, that's indeed a bug.

> > Generating one time-stamp in the Makefile is a pain in backside.  I have
> > come up with a way to do it, but it's fiddly.  Florian, Phil, would it
> > suffice to generate the time-stamp in configure?

I deliberately chose a build timestamp, not a configure one. In most
cases it won't matter, but since one could defeat the stamp by
recompiling after making changes without calling configure.

> Due to this issue, I can also see bogus:
> 
> # Warning: table ip x was created by a newer version of nftables? Content may be incomplete!
> 
> with partial recompilations while developing on nftables, it is a bit
> annoying because I have to: make clean and compile again. This
> occasionally triggers spurious tests failures here for that reason.

Requesting simple expansion by assigning to MAKE_STAMP using ':='
operator fixes the value throughout one build, but partial recompiling
still leads to objects compiled with different MAKE_STAMP values.

Looks like nftbuildstamp should reside in an object file which is forced
to recompile each time. MAKE_STAMP being consumed by a single object
also mitigates the recursive expansion. WDYT? Am I missing a detail?

Thanks, Phil