Make the Unix build process more repeatable by ngie-eign · Pull Request #28449 · openssl/openssl

ngie-eign · 2025-09-05T03:31:50Z

Before this change all manpages would contain the date when pod2man was
run. This resulted in outputs that differed between builds--or
potentially across a single build if the host clock "ticked" to the next
day when the build was being run.

This commit modifies the manpage generation process as follows:

The date all manpages were generated will be normalized to a single
date instead of a potentially rolling date.
The release date specified in VERSION.dat is used instead of the
date/time when pod2man was executed OR--in the event a date
isn't specified in VERSION.dat--the time when the Makefiles were
last regenerated.

Embedding a consistent date into the generated manpages helps ensure that
the build process as a whole is more repeatable and helps ensure that
release versions of OpenSSL create artifacts consistent with the date
that the official release was cut.

Closes: #28323

Configurations/unix-Makefile.tmpl

kroeckx · 2025-09-05T08:59:29Z

I'm wondering what the effect is when VERSION.dat doesn't contain a date, like in the current branch.

In Debian, we set the SOURCE_DATE_EPOCH, which is based on the debian/changelog file. It would now get an other date, when upstream released it, instead of when Debian did, which looks fine to me.

t8m

It is borderline on what we would accept with CLA: trivial. Please consider signing a CLA. https://openssl-library.org/policies/cla/index.html

levitte · 2025-09-05T11:43:19Z

I'm wondering what the effect is when VERSION.dat doesn't contain a date, like in the current branch.

my $t = $config{"release_date"}
      ? Time::Piece->strptime($config{"release_date"}, "%d %b %Y")
      : localtime;
$t->strftime("%Y-%m-%d")

When the release date ($config{"release_date"}) is empty, it's falsy, so localtime will be used to determine the date.

levitte · 2025-09-05T11:44:44Z

It is borderline on what we would accept with CLA: trivial. Please consider signing a CLA. https://openssl-library.org/policies/cla/index.html

I could accept it with CLA: trivial

kroeckx · 2025-09-05T14:18:44Z

So if we ever decide to shipped a non-released version, which seems unlikely, this will make it non-reproducible.

ngie-eign · 2025-09-05T15:45:20Z

It is borderline on what we would accept with CLA: trivial. Please consider signing a CLA. https://openssl-library.org/policies/cla/index.html

I could accept it with CLA: trivial

I submitted my individual CLA just last night. The second commit doesn't contain that metadata because I planned on squashing the second commit to the first one (which has the metadata) prior to merge.

ngie-eign · 2025-09-05T15:50:48Z

So if we ever decide to shipped a non-released version, which seems unlikely, this will make it non-reproducible.

Yes. That seems extremely unlikely though, since releasing sources without a fixed version to the public would be contradictory.

Background for other readers: multiple OSes out there (I can speak directly to FreeBSD and a FreeBSD variant I develop on for work) keep patches which normalize dates to deterministic values in order to make builds reproducible. This is sometimes done for to simplify binary patching processes.

Before this change all manpages would contain the date when pod2man was run. This resulted in outputs that differed between builds--or potentially across a single build if the host clock "ticked" to the next day when the build was being run. This commit modifies the manpage generation process as follows: - The date all manpages were generated will be normalized to a single date. - The release date specified in `VERSION.dat` is used instead of the date/time when `pod2man` was executed OR--in the event a date isn't specified in `VERSION.dat`--the time when the Makefiles were last regenerated. Embedding a consistent date into the generated manpages helps ensure that the build process as a whole is more repeatable and helps ensure that release versions of OpenSSL create artifacts consistent with the date that the official release was cut. Co-authored-by: Richard Levitte <[email protected]> Signed-off-by: Enji Cooper <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #28449) (cherry picked from commit 2c0c9c8)

Before this change all manpages would contain the date when pod2man was run. This resulted in outputs that differed between builds--or potentially across a single build if the host clock "ticked" to the next day when the build was being run. This commit modifies the manpage generation process as follows: - The date all manpages were generated will be normalized to a single date. - The release date specified in `VERSION.dat` is used instead of the date/time when `pod2man` was executed OR--in the event a date isn't specified in `VERSION.dat`--the time when the Makefiles were last regenerated. Embedding a consistent date into the generated manpages helps ensure that the build process as a whole is more repeatable and helps ensure that release versions of OpenSSL create artifacts consistent with the date that the official release was cut. Co-authored-by: Richard Levitte <[email protected]> Signed-off-by: Enji Cooper <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #28449)

t8m · 2025-09-09T09:38:23Z

Merged to all the active branches. Thank you for your contribution.

CHANGES.md: * openssl#28398 * openssl#28411 * openssl#28447 * openssl#28449 NEWS.md: * openssl#28447 Release: yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

CHANGES.md: * #28398 * #28411 * #28447 * #28449 NEWS.md: * #28447 Release: yes Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from #28521)

CHANGES.md: * openssl#28398 * openssl#28411 * openssl#28447 * openssl#28449 NEWS.md: * openssl#28447 Release: yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

CHANGES.md: * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28447 * openssl#28449 NEWS.md: * openssl#28447 Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

CHANGES.md: * #28198 * #28398 * #28411 * #28447 * #28449 NEWS.md: * #28447 Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from #28558)

CHANGES.md: * #28398 * #28411 * #28447 * #28449 NEWS.md: * #28447 Release: yes Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #28547)

3.0.18 CHANGES.md includes the following: * openssl#28098 * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28449 * openssl#28504 * openssl#28535 * openssl#28591 * openssl#28624 Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

3.2.6 CHANGES.md includes the following: * openssl#28098 * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28449 * openssl#28504 * openssl#28535 * openssl#28591 * openssl#28603 * openssl#28624 * openssl#28642 3.2.6 NEWS.md do not have any updates. Updated the changes and news in the previous branches. Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

3.3.5 CHANGES.md includes the following: * openssl#28098 * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28449 * openssl#28504 * openssl#28535 * openssl#28591 * openssl#28603 * openssl#28624 * openssl#28642 3.3.5 NEWS.md do not have any updates. Updated the changes and news in the previous branches. Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

3.4.3 CHANGES.md includes the following: * openssl#28098 * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28415 * openssl#28449 * openssl#28504 * openssl#28535 * openssl#28591 * openssl#28603 * openssl#28624 * openssl#28642 3.4.3 NEWS.md do not have any updates. Updated the changes and news in the previous branches. Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

3.3.5 CHANGES.md includes the following: * openssl#28098 * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28449 * openssl#28504 * openssl#28535 * openssl#28591 * openssl#28603 * openssl#28624 * openssl#28642 3.3.5 NEWS.md do not have any updates. Updated the changes and news in the previous branches. Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

3.4.3 CHANGES.md includes the following: * openssl#28098 * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28415 * openssl#28449 * openssl#28504 * openssl#28535 * openssl#28591 * openssl#28603 * openssl#28624 * openssl#28642 3.4.3 NEWS.md do not have any updates. Updated the changes and news in the previous branches. Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

3.2.6 CHANGES.md includes the following: * openssl#28098 * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28449 * openssl#28504 * openssl#28535 * openssl#28591 * openssl#28603 * openssl#28624 * openssl#28642 3.2.6 NEWS.md do not have any updates. Updated the changes and news in the previous branches. Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

3.0.18 CHANGES.md includes the following: * openssl#28098 * openssl#28198 * openssl#28398 * openssl#28411 * openssl#28449 * openssl#28504 * openssl#28535 * openssl#28591 * openssl#28624 Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]>

3.4.3 CHANGES.md includes the following: * #28198 * #28398 * #28411 * #28415 * #28449 Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]>

3.3.5 CHANGES.md includes the following: * #28198 * #28398 * #28411 * #28449 Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]>

3.2.6 CHANGES.md includes the following: * #28198 * #28398 * #28411 * #28449 Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]>

3.0.18 CHANGES.md includes the following: * #28198 * #28398 * #28411 * #28449 Release: Yes Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]>

openssl-machine added the hold: cla required The contributor needs to submit a license agreement label Sep 5, 2025

ngie-eign force-pushed the issue-28323 branch from 91dab0a to 55c9d44 Compare September 5, 2025 03:32

openssl-machine removed the hold: cla required The contributor needs to submit a license agreement label Sep 5, 2025

ngie-eign force-pushed the issue-28323 branch from 55c9d44 to 4b44ba5 Compare September 5, 2025 03:33

ngie-eign changed the title ~~Make the OpenSSL build more repeatable~~ Make the build process more repeatable Sep 5, 2025

ngie-eign mentioned this pull request Sep 5, 2025

Build process is not repeatable: file "generation" date embedded in manages #28323

Closed

ngie-eign force-pushed the issue-28323 branch from 4b44ba5 to 887cc15 Compare September 5, 2025 04:38

levitte reviewed Sep 5, 2025

View reviewed changes

Configurations/unix-Makefile.tmpl Outdated Show resolved Hide resolved

openssl-machine added the hold: cla required The contributor needs to submit a license agreement label Sep 5, 2025

levitte added branch: master Applies to master branch branch: 3.0 Applies to openssl-3.0 branch branch: 3.3 Applies to openssl-3.3 branch: 3.4 Applies to openssl-3.4 branch: 3.5 Applies to openssl-3.5 branch: 3.6 Applies to openssl-3.6 branch: 3.2 Applies to openssl-3.2 (EOL) labels Sep 5, 2025

t8m previously approved these changes Sep 5, 2025

View reviewed changes

openssl-machine added the hold: cla required The contributor needs to submit a license agreement label Sep 5, 2025

ngie-eign dismissed t8m’s stale review via e03c8ac September 5, 2025 16:37

t8m closed this Sep 9, 2025

esyr mentioned this pull request Sep 11, 2025

[3.6] CHANGES.md, NEWS.md: update for 3.6.0-beta1 #28521

Closed

esyr mentioned this pull request Sep 15, 2025

[3.5] CHANGES.md, NEWS.md: update for 3.5.3 #28558

Closed

levitte mentioned this pull request Sep 29, 2025

Preserve manpage date when installing OpenSSL #28328

Closed

2 tasks

esyr mentioned this pull request Sep 30, 2025

[3.0] CHANGES.md: update for 3.0.18 #28697

Closed

ngie-eign deleted the issue-28323 branch October 28, 2025 15:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Comments

Make the Unix build process more repeatable#28449

Make the Unix build process more repeatable#28449
ngie-eign wants to merge 1 commit intoopenssl:masterfrom
ngie-eign:issue-28323

ngie-eign commented Sep 5, 2025 •

edited

Loading

Uh oh!

Uh oh!

kroeckx commented Sep 5, 2025

Uh oh!

t8m left a comment

Uh oh!

levitte commented Sep 5, 2025

Uh oh!

levitte commented Sep 5, 2025

Uh oh!

kroeckx commented Sep 5, 2025

Uh oh!

ngie-eign commented Sep 5, 2025

Uh oh!

ngie-eign commented Sep 5, 2025

Uh oh!

t8m commented Sep 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Uh oh!

Comments

Conversation

ngie-eign commented Sep 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kroeckx commented Sep 5, 2025

Uh oh!

t8m left a comment

Choose a reason for hiding this comment

Uh oh!

levitte commented Sep 5, 2025

Uh oh!

levitte commented Sep 5, 2025

Uh oh!

kroeckx commented Sep 5, 2025

Uh oh!

ngie-eign commented Sep 5, 2025

Uh oh!

ngie-eign commented Sep 5, 2025

Uh oh!

t8m commented Sep 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

ngie-eign commented Sep 5, 2025 •

edited

Loading