Hacker News Reader

The output of "apt-get moo" changes on special days (4/1, 12/25, 8/16, 11/7, 2/18). So if another program was using "apt-get moo" in its build script, the build would not be reproducible. With the patch, the SOURCE_DATE_EPOCH environment variable can be set to make "apt-get moo" deterministic.

I don't think anything actually uses "apt-get moo" in its build script.

This kind of patch makes more sense for build tools like "ar" (static library creator). By default, "ar" injects a timestamp into the output file, so the binary is different each build. But, use the "D" flag and "ar" becomes deterministic.

The time-dependent part can be seen here: https://github.com/Debian/apt/blob/master/apt-private/privat...

There is a second part above too:

https://github.com/Debian/apt/blob/master/apt-private/privat...

Yeh I only skimmed the patch but I presumed "reproducable build" referred to the actual binary, and the patch addresses runtime behaviour. Guess I'm missing something.

It doesn't; it makes anyone using the output...

From what I can read in patch file, it seems to be doing something different on April fools day.