BUG: fix mtime of sdist archive members

Set the mtime of all archive members to the mtime set by meson dist,
also for files that may have been locally modified. Use the current
time for the PKG-INFO file.

Drop support for the $SOURCE_DATE_EPOCH environment variable when
creating the sdist. This environment variable is for meant to be used
as a work-around for build tools that produce non-reproducible binary
packages. It does not have a standardized meaning for tools producing
source distributions.

See https://reproducible-builds.org/docs/source-date-epoch/

Fixes mesonbuild#450.

Author: dnicolodi

mesonpy/__init__.py

@@ -31,6 +31,7 @@
 import tarfile
 import tempfile
 import textwrap
+import time
 import typing
 import warnings
 
@@ -919,7 +920,7 @@ def sdist(self, directory: Path) -> pathlib.Path:
         meson_dist_path = pathlib.Path(self._build_dir, 'meson-dist', f'{meson_dist_name}.tar.gz')
         sdist = pathlib.Path(directory, f'{dist_name}.tar.gz')
 
-        with tarfile.open(meson_dist_path, 'r:gz') as meson_dist, mesonpy._util.create_targz(sdist) as (tar, mtime):
+        with tarfile.open(meson_dist_path, 'r:gz') as meson_dist, mesonpy._util.create_targz(sdist) as tar:
             for member in meson_dist.getmembers():
                 # calculate the file path in the source directory
                 assert member.name, member.name
@@ -946,6 +947,7 @@ def sdist(self, directory: Path) -> pathlib.Path:
 
                 info = tarfile.TarInfo(member.name)
                 file_stat = os.stat(path)
+                info.mtime = member.mtime
                 info.size = file_stat.st_size
                 info.mode = int(oct(file_stat.st_mode)[-3:], 8)
 
@@ -961,8 +963,7 @@ def sdist(self, directory: Path) -> pathlib.Path:
 
             # add PKG-INFO to dist file to make it a sdist
             pkginfo_info = tarfile.TarInfo(f'{dist_name}/PKG-INFO')
-            if mtime:
-                pkginfo_info.mtime = mtime
+            pkginfo_info.mtime = time.time()  # type: ignore[assignment]
             pkginfo_info.size = len(self.metadata)
             tar.addfile(pkginfo_info, fileobj=io.BytesIO(self.metadata))
 

mesonpy/_util.py

@@ -48,18 +48,13 @@ def add_ld_path(paths: Iterable[str]) -> Iterator[None]:
 
 
 @contextlib.contextmanager
-def create_targz(path: Path) -> Iterator[Tuple[tarfile.TarFile, Optional[int]]]:
+def create_targz(path: Path) -> Iterator[tarfile.TarFile]:
     """Opens a .tar.gz file in the file system for edition.."""
 
-    # reproducibility
-    source_date_epoch = os.environ.get('SOURCE_DATE_EPOCH')
-    mtime = int(source_date_epoch) if source_date_epoch else None
-
     os.makedirs(os.path.dirname(path), exist_ok=True)
     file = typing.cast(IO[bytes], gzip.GzipFile(
         path,
         mode='wb',
-        mtime=mtime,
     ))
     tar = tarfile.TarFile(
         mode='w',
@@ -68,7 +63,7 @@ def create_targz(path: Path) -> Iterator[Tuple[tarfile.TarFile, Optional[int]]]:
     )
 
     with contextlib.closing(file), tar:
-        yield tar, mtime
+        yield tar
 
 
 class CLICounter:

tests/packages/limited-api/limited-api

@@ -0,0 +1,11 @@
+  /Users/daniele/src/meson-python/tests/packages/limited-api:
+  drwxr-xr-x 10 daniele staff  320 Aug 15 20:19 .
+  drwxr-xr-x 33 daniele staff 1056 Aug 15 19:03 ..
+  -rw-r--r--  1 daniele staff  283 Aug 15 20:19 meson.build
+  -rw-r--r--  1 daniele staff   42 Aug 15 19:03 meson.build~
+  -rw-r--r--  1 daniele staff  583 Aug 15 20:16 module.c
+  -rw-r--r--  1 daniele staff  500 Aug 15 20:06 module.c~
+  -rw-r--r--  1 daniele staff   44 Aug 15 20:19 meson.options
+  -rw-r--r--  1 daniele staff   27 Aug 15 20:19 options.meson~
+  -rw-r--r--  1 daniele staff  202 Aug 15 19:04 pyproject.toml
+  -rw-r--r--  1 daniele staff  202 Aug 15 19:04 pyproject.toml~

tests/packages/limited-api/meson.build

@@ -0,0 +1,18 @@
+project('limoted-api', 'c', version: '1.0.0')
+
+py = import('python').find_installation()
+
+py.extension_module(
+  'module',
+  'module.c',
+  limited_api: '3.7',
+  install: true,
+)
+
+if get_option('extra')
+  py.extension_module(
+    'extra',
+    'module.c',
+    install: true,
+  )
+endif

tests/packages/limited-api/meson.options

@@ -0,0 +1 @@
+option('extra', type: 'boolean', value: false)

tests/packages/limited-api/module.c

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: 2021 The meson-python developers
+//
+// SPDX-License-Identifier: MIT
+
+#include <Python.h>
+
+static PyObject* add(PyObject *self, PyObject *args) {
+    int a, b;
+
+    if (!PyArg_ParseTuple(args, "ii", &a, &b))
+        return NULL;
+
+    return PyLong_FromLong(a + b);
+}
+
+static PyMethodDef methods[] = {
+    {"add", add, METH_VARARGS, NULL},
+    {NULL, NULL, 0, NULL},
+};
+
+static struct PyModuleDef module = {
+    PyModuleDef_HEAD_INIT,
+    "plat",
+    NULL,
+    -1,
+    methods,
+};
+
+PyMODINIT_FUNC PyInit_module(void) {
+    return PyModule_Create(&module);
+}

tests/packages/limited-api/pyproject.toml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2023 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+[build-system]
+build-backend = 'mesonpy'
+requires = ['meson-python']
+
+[tool.meson-python]
+limited-api = true

tests/test_sdist.py

@@ -17,7 +17,8 @@
 
 def test_contents(sdist_library):
     with tarfile.open(sdist_library, 'r:gz') as sdist:
-        names = set(sdist.getnames())
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
 
     assert names == {
         'library-1.0.0/example.c',
@@ -28,10 +29,14 @@ def test_contents(sdist_library):
         'library-1.0.0/PKG-INFO',
     }
 
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes
+
 
 def test_contents_subdirs(sdist_subdirs):
     with tarfile.open(sdist_subdirs, 'r:gz') as sdist:
-        names = set(sdist.getnames())
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
 
     assert names == {
         'subdirs-1.0.0/PKG-INFO',
@@ -43,6 +48,9 @@ def test_contents_subdirs(sdist_subdirs):
         'subdirs-1.0.0/subdirs/b/c.py',
     }
 
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes
+
 
 def test_contents_unstaged(package_pure, tmp_path):
     new_data = textwrap.dedent('''
@@ -65,7 +73,8 @@ def bar():
         os.unlink('crap')
 
     with tarfile.open(tmp_path / sdist_path, 'r:gz') as sdist:
-        names = set(sdist.getnames())
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
         read_data = sdist.extractfile('pure-1.0.0/pure.py').read().replace(b'\r\n', b'\n')
 
     assert names == {
@@ -76,6 +85,9 @@ def bar():
     }
     assert read_data == new_data.encode()
 
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes
+
 
 @pytest.mark.skipif(sys.platform in {'win32', 'cygwin'}, reason='Platform does not support executable bit')
 def test_executable_bit(sdist_executable_bit):
@@ -94,7 +106,11 @@ def test_executable_bit(sdist_executable_bit):
 
 
 def test_generated_files(sdist_generated_files):
-    expected = {
+    with tarfile.open(sdist_generated_files, 'r:gz') as sdist:
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
+
+    assert names == {
         'executable_bit-1.0.0/PKG-INFO',
         'executable_bit-1.0.0/example-script.py',
         'executable_bit-1.0.0/example.c',
@@ -104,5 +120,6 @@ def test_generated_files(sdist_generated_files):
         'executable_bit-1.0.0/_version_meson.py',
         'executable_bit-1.0.0/generate_version.py',
     }
-    with tarfile.open(sdist_generated_files, 'r:gz') as sdist:
-        assert {tar.name for tar in sdist.getmembers()} == expected
+
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes