Paul A. Patience <paul@apatience.com> skribis:

> On Sunday, July 18th, 2021 at 16:27, Kaz Kylheku <kaz@kylheku.com> wrote:
>> Either Ubuntu has a different upstream for these tools, or else they
>> have some patches (which would be worth stealing instead of repeating
>> the work).
>>
>> Moreover, if Ubuntu has patches for this, it might be getting them from
>> Debian.
>
> I know Debian is making great efforts to obtain reproducible builds [1],
> and in fact if you look at the first message of the bug report I
> previously linked [2], they mention that they have been using some
> custom patches to get Ghostscript to produce reproducible output
> (on Debian).
> In fact, we can find some information about Debian's Ghostscript patch
> here [3], though unfortunately the link to the patch is dead.
>
> (There is also more information about reproducible builds here [4].)
>
> Best regards,
> Paul
>
> [1]: https://isdebianreproducibleyet.com/
> [2]: https://bugs.ghostscript.com/show_bug.cgi?id=696765
> [3]: https://wiki.debian.org/ReproducibleBuilds/PdfGeneratedByGhostscript
> [4]: https://wiki.debian.org/ReproducibleBuilds/Howto

So Debian indeed has a patch adding the possibility to set the timestamp
based on SOURCE_DATE_EPOCH (see '2010_add_build_timestamp_setting.patch'
in [1] for example).

Guix also has a patch, but a different one based on GS_GENERATE_UUIDS.
However this patch is missing a part disabling two of the timestamps.
I proposed a patch to fix that (see [2]).
With this fix, 'pdf-clobber-stamps.tl' is not necessary anymore to build
the documentation reproducibly in Guix, but it might still be useful for
some other build environments.

[1] http://security.debian.org/debian-security/pool/updates/main/g/ghostscript/ghostscript_9.26a~dfsg-0+deb9u7.debian.tar.xz
[2] https://bugs.gnu.org/49640