php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #69727 Remove timestamps from build to make it reproducible
Submitted: 2015-05-29 08:19 UTC Modified: 2015-09-16 16:16 UTC
Votes:2
Avg. Score:4.0 ± 1.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: thijs at debian dot org Assigned:
Status: Closed Package: Unknown/Other Function
PHP Version: 5.6.9 OS:
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: thijs at debian dot org
New email:
PHP Version: OS:

 

 [2015-05-29 08:19 UTC] thijs at debian dot org 
Description:
------------
The PHP build embeds timestamps into the generated binaries at build time. This makes the build not reproducible, as in that the same source code will not generate the bitwise exact same binaries.

Reproducible builds are important amongst others to verify the integrity of distributions. See: https://wiki.debian.org/ReproducibleBuilds

We believe the value of the embedded timestamps is very limited. They do not indicate which release, commit or git branch has been built, only a date which in itself does not really say something. Therefore it seems safe to remove them.

Test script:
---------------
https://reproducible.debian.net/rb-pkg/unstable/amd64/php5.html

Expected result:
----------------
Building PHP two times yields bitwise identical binaries.

Actual result:
--------------
Building PHP two times yields bitwise different binaries.

Patches

php5_reproducible (last revision 2015-05-29 08:19 UTC by thijs at debian dot org)

Pull Requests

Pull requests:

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-09-16 16:16 UTC] levim@php.net 
To your knowledge is there anything else that prevents reproducible builds for PHP?
 [2017-12-15 21:04 UTC] nikic@php.net 
Automatic comment on behalf of jelle@vdwaa.nl
Revision: http://git.php.net/?p=php-src.git;a=commit;h=8a179fa02b50685fba47e7d19af922b07791d616
Log: Fix bug #69727: Support SOURCE_DATE_EPOCH for Build Date
 [2017-12-15 21:05 UTC] nikic@php.net
-Status: Open +Status: Closed
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri Mar 21 18:01:30 2025 UTC