Reproducable builds

[James Browning]

> On 08/04/2026 8:32 PM PDT Hal Murray via devel <devel at ntpsec.org> wrote:
>  
> I started looking at the patch files.  Looks good, thanks.
> 
> But it's hard to verify all that by eyeball.  Is there a way we can get 
> the reproducable build stuff to verify that you haven't make any real 
> changes?

Set SOURCE_DATE_EPOCH to some reasonable number and always build
into build/. The change in merge request 1503 to set that
environment variable is probably half wrong. 

I had an alternative that would touch files with their last committed timestamps from their git history. I keep deleting it. 

> If I build ntpd, get the checksum, build again (no source changes) I get 
> the same sum.
> 
> If I add a comment, I get a different sum.

It should strip the comments out, unless you're building with "-g".

Drat, I think I set it to build with "-g".

Probably add "--disable-debug-gdb" to "./waf configure" drat.

Also, probably revert commit
20a2eaf63d6bd6738f32f8e841e8e1aa181b5cea

> Is there a flag or such that will leave ignore comments?

> I can use objdump to look at the code.  It puts the file name in the 
> output, but skipping that part of a diff by hand is pretty simple.
> 
> 1529 looks clean.
> 
> 1530 says:
> 21280c21280
> <    15875:	be 38 0f 00 00       	mov    $0xf38,%esi
> ---
> >    15875:	be 46 0f 00 00       	mov    $0xf46,%esi
> 24790c24790
> <    19113:	be 44 09 00 00       	mov    $0x944,%esi
> ---
> >    19113:	be 4d 09 00 00       	mov    $0x94d,%esi
> 
> 1531 and 1532 are clean.
> 
> 
> Do you want me to approve the ones I like?