[Rd] [4 of 4] [Success] Revisiting and updating reproducible builds for base R in Debian

[Dirk Eddelbuettel]

A belated update to an earlier thread, and good news: R builds reproducibly!!

Special thanks for Kurt for assistance with an autoconf/m4 aspect (we longer
show a hostname which may differ if different nodes get assigned the
different builds that are compared), and to the powerhouse team of Kevin and
his assistance Claude :) (for staring down some gnarly aspects of how
internal packages 'tools' and 'methods' are built when R is built). Along
with an earlier fix I managed by myself ;-) and all the earlier patches we
had done already in 2017 (!!) we are now at a point where R builds
reproducibly.

We had already used an earlier variable PKG_BUILT_STAMP just for the Debian
side, now along with the 'more official' one SOURCE_DATE_EPOCH. I will ensure
all my patches use only SOURCE_DATE_EPOCH -- which is cross-distro and will
ensure other builds besides Debian will be reproducible -- and ensure those
patches land in base R.

To recap as there had been confusion, and possible hesitation by e.g. Simon
who seemed to read all this as a way of interfering with how his overload of
build stamps in generated DESCRIPTION files is used where we lack
representation of built-version numbers in binary artifact filenames: it has
nothing to do with any of that. By default, Sys.time() is used as before in
all builds. But if and when a special timestamp env var is used (and will
standardize on SOURCE_DATE_EPOCH) then binary artifacts (when patched) use
this 'source archive time' when set instead of wallclock at the time of
building. When set, this makes two subsequent or almost concurrent builds
binary identical (as we also stopped representing build-machine hostnames and
other sources of differences).

All this is current in patches inside the debian/patches/ directory indexed
by debian/patches/series (and hence ignoring some other older ones there) at
the repo at https://salsa.debian.org/edd/r-base and more public browseable
mirrors such as https://sources.debian.org/src/r-base/4.6.1-9 for the current
(Debian) patch version.

Cheers, Dirk

-- 
dirk.eddelbuettel.com | @eddelbuettel | edd using debian.org