BUG: fix mtime of sdist archive members

Set the mtime of all archive members to the mtime set by meson dist,
also for files that may have been locally modified. Use the current
time for the PKG-INFO file.

Drop support for the $SOURCE_DATE_EPOCH environment variable when
creating the sdist. This environment variable is for meant to be used
as a work-around for build tools that produce non-reproducible binary
packages. It does not have a standardized meaning for tools producing
source distributions.

See https://reproducible-builds.org/docs/source-date-epoch/

Fixes #450.

Author: dnicolodi

mesonpy/__init__.py

@@ -31,6 +31,7 @@
 import tarfile
 import tempfile
 import textwrap
+import time
 import typing
 import warnings
 
@@ -928,7 +929,7 @@ def sdist(self, directory: Path) -> pathlib.Path:
         meson_dist_path = pathlib.Path(self._build_dir, 'meson-dist', f'{meson_dist_name}.tar.gz')
         sdist = pathlib.Path(directory, f'{dist_name}.tar.gz')
 
-        with tarfile.open(meson_dist_path, 'r:gz') as meson_dist, mesonpy._util.create_targz(sdist) as (tar, mtime):
+        with tarfile.open(meson_dist_path, 'r:gz') as meson_dist, mesonpy._util.create_targz(sdist) as tar:
             for member in meson_dist.getmembers():
                 # calculate the file path in the source directory
                 assert member.name, member.name
@@ -955,6 +956,7 @@ def sdist(self, directory: Path) -> pathlib.Path:
 
                 info = tarfile.TarInfo(member.name)
                 file_stat = os.stat(path)
+                info.mtime = member.mtime
                 info.size = file_stat.st_size
                 info.mode = int(oct(file_stat.st_mode)[-3:], 8)
 
@@ -970,8 +972,7 @@ def sdist(self, directory: Path) -> pathlib.Path:
 
             # add PKG-INFO to dist file to make it a sdist
             pkginfo_info = tarfile.TarInfo(f'{dist_name}/PKG-INFO')
-            if mtime:
-                pkginfo_info.mtime = mtime
+            pkginfo_info.mtime = time.time()  # type: ignore[assignment]
             pkginfo_info.size = len(self.metadata)
             tar.addfile(pkginfo_info, fileobj=io.BytesIO(self.metadata))
 

mesonpy/_util.py

@@ -18,8 +18,6 @@
 
 
 if typing.TYPE_CHECKING:  # pragma: no cover
-    from typing import Optional, Tuple
-
     from mesonpy._compat import Iterable, Iterator, Path
 
 
@@ -48,18 +46,13 @@ def add_ld_path(paths: Iterable[str]) -> Iterator[None]:
 
 
 @contextlib.contextmanager
-def create_targz(path: Path) -> Iterator[Tuple[tarfile.TarFile, Optional[int]]]:
+def create_targz(path: Path) -> Iterator[tarfile.TarFile]:
     """Opens a .tar.gz file in the file system for edition.."""
 
-    # reproducibility
-    source_date_epoch = os.environ.get('SOURCE_DATE_EPOCH')
-    mtime = int(source_date_epoch) if source_date_epoch else None
-
     os.makedirs(os.path.dirname(path), exist_ok=True)
     file = typing.cast(IO[bytes], gzip.GzipFile(
         path,
         mode='wb',
-        mtime=mtime,
     ))
     tar = tarfile.TarFile(
         mode='w',
@@ -68,7 +61,7 @@ def create_targz(path: Path) -> Iterator[Tuple[tarfile.TarFile, Optional[int]]]:
     )
 
     with contextlib.closing(file), tar:
-        yield tar, mtime
+        yield tar
 
 
 class CLICounter:

tests/test_sdist.py

@@ -17,7 +17,8 @@
 
 def test_contents(sdist_library):
     with tarfile.open(sdist_library, 'r:gz') as sdist:
-        names = set(sdist.getnames())
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
 
     assert names == {
         'library-1.0.0/example.c',
@@ -28,10 +29,14 @@ def test_contents(sdist_library):
         'library-1.0.0/PKG-INFO',
     }
 
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes
+
 
 def test_contents_subdirs(sdist_subdirs):
     with tarfile.open(sdist_subdirs, 'r:gz') as sdist:
-        names = set(sdist.getnames())
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
 
     assert names == {
         'subdirs-1.0.0/PKG-INFO',
@@ -43,6 +48,9 @@ def test_contents_subdirs(sdist_subdirs):
         'subdirs-1.0.0/subdirs/b/c.py',
     }
 
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes
+
 
 def test_contents_unstaged(package_pure, tmp_path):
     new_data = textwrap.dedent('''
@@ -65,7 +73,8 @@ def bar():
         os.unlink('crap')
 
     with tarfile.open(tmp_path / sdist_path, 'r:gz') as sdist:
-        names = set(sdist.getnames())
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
         read_data = sdist.extractfile('pure-1.0.0/pure.py').read().replace(b'\r\n', b'\n')
 
     assert names == {
@@ -76,6 +85,9 @@ def bar():
     }
     assert read_data == new_data.encode()
 
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes
+
 
 @pytest.mark.skipif(sys.platform in {'win32', 'cygwin'}, reason='Platform does not support executable bit')
 def test_executable_bit(sdist_executable_bit):
@@ -94,7 +106,11 @@ def test_executable_bit(sdist_executable_bit):
 
 
 def test_generated_files(sdist_generated_files):
-    expected = {
+    with tarfile.open(sdist_generated_files, 'r:gz') as sdist:
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
+
+    assert names == {
         'executable_bit-1.0.0/PKG-INFO',
         'executable_bit-1.0.0/example-script.py',
         'executable_bit-1.0.0/example.c',
@@ -104,5 +120,6 @@ def test_generated_files(sdist_generated_files):
         'executable_bit-1.0.0/_version_meson.py',
         'executable_bit-1.0.0/generate_version.py',
     }
-    with tarfile.open(sdist_generated_files, 'r:gz') as sdist:
-        assert {tar.name for tar in sdist.getmembers()} == expected
+
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes