fedora-reproducible-builds / project

#6 Check that sources actually match SourceN links in spec files
Opened by zbyszek. Modified

Open
Close Issue

I don't think we do this at scale, but it'd be useful to check. We could do this separately from the other steps. Redownload all sources for which a URL is given, check that the hash matches what sources file lists for the filename.

For sources for which no URL is given and provide a separate listing, we should warn: in many cases, a URL could be provided, for example patches. We should push people towards doing that wherever possible.

@ikruglov put up a PR for this at https://pagure.io/rpmdevtools/pull-request/116

I left some comments:
https://pagure.io/rpmdevtools/pull-request/116#comment-203840

TL;DR: I don't think spectool is a good place to put this functionality.

Going back to this, I recently discovered that all Sources pointing to Gerrit repository snapshots are non-deterministic, as every time you request an archive from it, new archive is generated on the fly, with timestamps set to current timestamp. Other code forges don't have this issue, most set file timestamp to commit timestamp.

Example:

$ wget https://gerrit.googlesource.com/git-repo/+archive/v2.60.1.tar.gz -O 1.tgz
$ wget https://gerrit.googlesource.com/git-repo/+archive/v2.60.1.tar.gz -O 2.tgz
$ sha256sum 1.tgz 2.tgz
33909f0204139c949e4bdbfb01e0dbbcfd422730d74d046668dcfcd1305fb628  1.tgz
0abc320b1a8448ee7ed6d4cad2a0473e83fa8669955e477d88cd5c56b91d268f  2.tgz
$ diffoscope 1.tgz 2.tgz
--- 1.tgz
+++ 2.tgz
│   --- 1.tgz-content
├── +++ 2.tgz-content
│ ├── file list
│ │ @@ -1,159 +1,159 @@
│ │ --rw-r--r--   0        0        0      403 2026-02-02 19:27:45.390000 .flake8
│ │ +-rw-r--r--   0        0        0      403 2026-02-02 19:27:54.311000 .flake8

Example Gerrit forges: gerrit.googlesource.com, chromium.googlesource.com, kernel.googlesource.com, android.googlesource.com.

(When talking to @dcavalca about it in person, I confused gerrit with cgit. My bad, cgit is fine.)

cc @salimma

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.