feat: reproducible packages

arch/arch.go

@@ -151,7 +151,7 @@ func (ArchLinux) Package(info *nfpm.Info, w io.Writer) error {
 	// .PKGINFO must be the first entry in .MTREE
 	entries = append([]MtreeEntry{*pkginfoEntry}, entries...)
 
-	err = createMtree(tw, entries)
+	err = createMtree(tw, entries, info.MTime)
 	if err != nil {
 		return fmt.Errorf("create mtree: %w", err)
 	}
@@ -311,7 +311,7 @@ func createPkginfo(info *nfpm.Info, tw *tar.Writer, totalSize int64) (*MtreeEntr
 		return nil, err
 	}
 
-	builddate := strconv.FormatInt(time.Now().Unix(), 10)
+	builddate := strconv.FormatInt(info.MTime.Unix(), 10)
 	totalSizeStr := strconv.FormatInt(totalSize, 10)
 
 	err = writeKVPairs(buf, map[string]string{
@@ -376,7 +376,7 @@ func createPkginfo(info *nfpm.Info, tw *tar.Writer, totalSize int64) (*MtreeEntr
 		Mode:     0o644,
 		Name:     ".PKGINFO",
 		Size:     int64(size),
-		ModTime:  time.Now(),
+		ModTime:  info.MTime,
 	})
 	if err != nil {
 		return nil, err
@@ -395,7 +395,7 @@ func createPkginfo(info *nfpm.Info, tw *tar.Writer, totalSize int64) (*MtreeEntr
 
 	return &MtreeEntry{
 		Destination: ".PKGINFO",
-		Time:        time.Now().Unix(),
+		Time:        info.MTime.Unix(),
 		Mode:        0o644,
 		Size:        int64(size),
 		Type:        files.TypeFile,
@@ -485,7 +485,7 @@ func (me *MtreeEntry) WriteTo(w io.Writer) (int64, error) {
 	}
 }
 
-func createMtree(tw *tar.Writer, entries []MtreeEntry) error {
+func createMtree(tw *tar.Writer, entries []MtreeEntry, mtime time.Time) error {
 	buf := &bytes.Buffer{}
 	gw := pgzip.NewWriter(buf)
 	defer gw.Close()
@@ -509,7 +509,7 @@ func createMtree(tw *tar.Writer, entries []MtreeEntry) error {
 		Mode:     0o644,
 		Name:     ".MTREE",
 		Size:     int64(buf.Len()),
-		ModTime:  time.Now(),
+		ModTime:  mtime,
 	})
 	if err != nil {
 		return err
@@ -562,7 +562,7 @@ func createScripts(info *nfpm.Info, tw *tar.Writer) error {
 		Mode:     0o644,
 		Name:     ".INSTALL",
 		Size:     int64(buf.Len()),
-		ModTime:  time.Now(),
+		ModTime:  info.MTime,
 	})
 	if err != nil {
 		return err

arch/arch_test.go

@@ -8,6 +8,7 @@ import (
 	"regexp"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/goreleaser/nfpm/v2"
 	"github.com/goreleaser/nfpm/v2/files"
@@ -16,6 +17,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+var mtime = time.Date(2023, 11, 5, 23, 15, 17, 0, time.UTC)
+
 func exampleInfo() *nfpm.Info {
 	return nfpm.WithDefaults(&nfpm.Info{
 		Name:        "foo-test",
@@ -297,7 +300,7 @@ func TestArchMtree(t *testing.T) {
 			Mode:        0o777,
 			Type:        files.TypeSymlink,
 		},
-	})
+	}, mtime)
 	require.NoError(t, err)
 
 	tw.Close()
@@ -362,7 +365,7 @@ func TestGlob(t *testing.T) {
 	require.NoError(t, err)
 
 	expected := map[string][]string{
-		"./.PKGINFO":                     {"mode=644", "size=185", "type=file"},
+		"./.PKGINFO":                     {"mode=644", "size=184", "type=file"},
 		"./usr/":                         {"mode=755", "type=dir"},
 		"./usr/share/":                   {"mode=755", "type=dir"},
 		"./usr/share/nfpm-repro/":        {"mode=755", "type=dir"},

deb/deb.go

@@ -125,15 +125,15 @@ func (d *Deb) Package(info *nfpm.Info, deb io.Writer) (err error) { // nolint: f
 		return fmt.Errorf("cannot write ar header to deb file: %w", err)
 	}
 
-	if err := addArFile(w, "debian-binary", debianBinary); err != nil {
+	if err := addArFile(w, "debian-binary", debianBinary, info.MTime); err != nil {
 		return fmt.Errorf("cannot pack debian-binary: %w", err)
 	}
 
-	if err := addArFile(w, "control.tar.gz", controlTarGz); err != nil {
+	if err := addArFile(w, "control.tar.gz", controlTarGz, info.MTime); err != nil {
 		return fmt.Errorf("cannot add control.tar.gz to deb: %w", err)
 	}
 
-	if err := addArFile(w, dataTarballName, dataTarball); err != nil {
+	if err := addArFile(w, dataTarballName, dataTarball, info.MTime); err != nil {
 		return fmt.Errorf("cannot add data.tar.gz to deb: %w", err)
 	}
 
@@ -143,7 +143,7 @@ func (d *Deb) Package(info *nfpm.Info, deb io.Writer) (err error) { // nolint: f
 			return err
 		}
 
-		if err := addArFile(w, "_gpg"+sigType, sig); err != nil {
+		if err := addArFile(w, "_gpg"+sigType, sig, info.MTime); err != nil {
 			return &nfpm.ErrSigningFailure{
 				Err: fmt.Errorf("add signature to ar file: %w", err),
 			}
@@ -255,7 +255,7 @@ func newDpkgSigFileLine(name string, fileContent []byte) dpkgSigFileLine {
 func readDpkgSigData(info *nfpm.Info, debianBinary, controlTarGz, dataTarball []byte) (io.Reader, error) {
 	data := dpkgSigData{
 		Signer: info.Deb.Signature.Signer,
-		Date:   time.Now(),
+		Date:   info.MTime,
 		Role:   info.Deb.Signature.Type,
 		Files: []dpkgSigFileLine{
 			newDpkgSigFileLine("debian-binary", debianBinary),
@@ -290,12 +290,12 @@ func (*Deb) SetPackagerDefaults(info *nfpm.Info) {
 	}
 }
 
-func addArFile(w *ar.Writer, name string, body []byte) error {
+func addArFile(w *ar.Writer, name string, body []byte, date time.Time) error {
 	header := ar.Header{
 		Name:    files.ToNixPath(name),
 		Size:    int64(len(body)),
 		Mode:    0o644,
-		ModTime: time.Now(),
+		ModTime: date,
 	}
 	if err := w.WriteHeader(&header); err != nil {
 		return fmt.Errorf("cannot write file header: %w", err)
@@ -510,7 +510,7 @@ func createChangelogInsideDataTar(
 		return 0, err
 	}
 
-	if err = newFileInsideTar(tarw, fileName, changelogData); err != nil {
+	if err = newFileInsideTar(tarw, fileName, changelogData, info.MTime); err != nil {
 		return 0, err
 	}
 
@@ -554,28 +554,18 @@ func createControl(instSize int64, md5sums []byte, info *nfpm.Info) (controlTarG
 		return nil, err
 	}
 
-	// ensure predefined sort order of these items
-	filesToCreateNames := []string{
-		"./control",
-		"./md5sums",
-		"./conffiles",
+	if err := newFileInsideTar(out, "./control", body.Bytes(), info.MTime); err != nil {
+		return nil, err
 	}
-
-	filesToCreateContent := [][]byte{
-		body.Bytes(),
-		md5sums,
-		conffiles(info),
+	if err := newFileInsideTar(out, "./md5sums", md5sums, info.MTime); err != nil {
+		return nil, err
 	}
-
-	triggers := createTriggers(info)
-	if len(triggers) > 0 {
-		filesToCreateNames = append(filesToCreateNames, "./triggers")
-		filesToCreateContent = append(filesToCreateContent, triggers)
+	if err := newFileInsideTar(out, "./conffiles", conffiles(info), info.MTime); err != nil {
+		return nil, err
 	}
 
-	for idx, name := range filesToCreateNames {
-		content := filesToCreateContent[idx]
-		if err := newFileInsideTar(out, name, content); err != nil {
+	if triggers := createTriggers(info); len(triggers) > 0 {
+		if err := newFileInsideTar(out, "./triggers", triggers, info.MTime); err != nil {
 			return nil, err
 		}
 	}
@@ -617,7 +607,13 @@ func createControl(instSize int64, md5sums []byte, info *nfpm.Info) (controlTarG
 
 	for path, destMode := range specialFiles {
 		if path != "" {
-			if err := newFilePathInsideTar(out, path, destMode.fileName, destMode.mode); err != nil {
+			if err := newFilePathInsideTar(
+				out,
+				path,
+				destMode.fileName,
+				destMode.mode,
+				info.MTime,
+			); err != nil {
 				return nil, err
 			}
 		}
@@ -642,18 +638,18 @@ func newItemInsideTar(out *tar.Writer, content []byte, header *tar.Header) error
 	return nil
 }
 
-func newFileInsideTar(out *tar.Writer, name string, content []byte) error {
+func newFileInsideTar(out *tar.Writer, name string, content []byte, modtime time.Time) error {
 	return newItemInsideTar(out, content, &tar.Header{
 		Name:     files.AsExplicitRelativePath(name),
 		Size:     int64(len(content)),
 		Mode:     0o644,
-		ModTime:  time.Unix(0, 0),
+		ModTime:  modtime,
 		Typeflag: tar.TypeReg,
 		Format:   tar.FormatGNU,
 	})
 }
 
-func newFilePathInsideTar(out *tar.Writer, path, dest string, mode int64) error {
+func newFilePathInsideTar(out *tar.Writer, path, dest string, mode int64, modtime time.Time) error {
 	file, err := os.Open(path) //nolint:gosec
 	if err != nil {
 		return err
@@ -666,7 +662,7 @@ func newFilePathInsideTar(out *tar.Writer, path, dest string, mode int64) error
 		Name:     files.AsExplicitRelativePath(dest),
 		Size:     int64(len(content)),
 		Mode:     mode,
-		ModTime:  time.Unix(0, 0),
+		ModTime:  modtime,
 		Typeflag: tar.TypeReg,
 		Format:   tar.FormatGNU,
 	})

deb/deb_test.go

@@ -16,6 +16,7 @@ import (
 	"strconv"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/blakesmith/ar"
 	"github.com/goreleaser/chglog"
@@ -30,6 +31,8 @@ import (
 // nolint: gochecknoglobals
 var update = flag.Bool("update", false, "update .golden files")
 
+var mtime = time.Date(2023, 11, 5, 23, 15, 17, 0, time.UTC)
+
 func exampleInfo() *nfpm.Info {
 	return nfpm.WithDefaults(&nfpm.Info{
 		Name:        "foo",
@@ -269,8 +272,8 @@ func TestSpecialFiles(t *testing.T) {
 	var w bytes.Buffer
 	out := tar.NewWriter(&w)
 	filePath := "testdata/templates.golden"
-	require.Error(t, newFilePathInsideTar(out, "doesnotexit", "templates", 0o644))
-	require.NoError(t, newFilePathInsideTar(out, filePath, "templates", 0o644))
+	require.Error(t, newFilePathInsideTar(out, "doesnotexit", "templates", 0o644, mtime))
+	require.NoError(t, newFilePathInsideTar(out, filePath, "templates", 0o644, mtime))
 	in := tar.NewReader(&w)
 	header, err := in.Next()
 	require.NoError(t, err)