NixOS/nixpkgs — pull request #2281 by alexanderkjeldaas (2014-04-15 14:02:10+00:00)
Title: Preview: deterministic build

This is a set of changes that makes the system_tarball_pc derivation deterministic.

Stdenv bootstrap:
- The stdenvs created during bootstrap are numbered to make it easier to debug/understand
- BUG: for the bootstrap stdenvs, binutils was after the bootstrap binaries in path.
- Deterministic archives are enabled early during bootstrapping of stdenvs.

Stdenv builder:
- The generic builder depends on libfaketime. *libfaketime needs a home*. libfaketime is currently distributed through github, that that does not work during bootstrap when SSL is not available. It should be moved to tarballs.nixos.org.
- Feature: Setting useFakeTime fixes the time during builds. This can break builds, but is easy to manage compared to patching. Additional environment variables are available for configuring libfaketime.
- Feature: A fake "date" utility is prepended to the path
- Check: The build directory (/tmp/nix-build-foo-x.y.z) is not allowed to appear in artifacts ($out) to avoid non-deterministic output.

Gcc:
- Gcc by default now defines __DATE__ and __TIME__ to be (time_t)0.
- TODO: -frandom-seed is not set. This is relevant for c++ code.

Various changes:
- The xsltproc utility creates random identifiers. A post-processing stage using perl was added to the nixos manual. This could be generalized.
- All uses of 'gzip -9' has been replaced with 'gzip -9n'.
- Added options to cpio for default uid/gid, and default mtime for tar.
- File lists are sorted before being added to cpio/tar.