Packaging linkerd-cli: embedding build time and date makes this non-reproducible

[johanneskastl]

What is the issue?

Dear maintainers,

while packaging linkerd-cli for openSUSE we found that the builds are not reproducible due to build time and date being embedded into the binary.

Here is the info from the bug report:

When building with debuginfo, this becomes nicely readable:

/usr/src/debug/linkerd-cli-edge-25.3.4/multicluster/static/generated_multicluster_templates.gogen.go
@@ -24,7 +24,7 @@       
                },      
                "/linkerd-multicluster": &vfsgen۰DirInfo{
                        name:    "linkerd-multicluster",
-                       modTime: time.Date(2025, 3, 28, 7, 49, 35, 787000000, time.UTC),
+                       modTime: time.Date(2041, 4, 29, 21, 6, 26, 307000000, time.UTC),
                },
                "/linkerd-multicluster/.helmignore": &vfsgen۰CompressedFileInfo{
                        name:             ".helmignore",
@@ -72,7 +72,7 @@
                },
                "/linkerd-multicluster/templates/controller": &vfsgen۰DirInfo{
                        name:    "controller",
-                       modTime: time.Date(2025, 3, 28, 7, 49, 35, 784000000, time.UTC),
+                       modTime: time.Date(2041, 4, 29, 21, 6, 26, 307000000, time.UTC),
                },

Could you please take a look and make the build time and date information configurable via e.g. ldflags? Other projects use things like buildDate or buildTime for setting this information.

On openSUSE, we normally use something like this to find out the date of the last change in the package that we are currently building (hence this does not change during builds, as the source stays the same):

DATE_FMT="+%%Y-%%m-%%dT%%H:%%M:%%SZ"
BUILD_DATE=$(date -u -d "@${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u -r "${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u "${DATE_FMT}")
# and then use ${BUILD_DATE} for e.g. ldflags

Kind Regards, Johannes

How can it be reproduced?

Build the binary twice, using the same source code state. Notice that there will be differences between the builds.

Logs, error output, etc

see above.

output of linkerd check -o short

(does not apply)

Environment

(build issue, hence not applicable)

Possible solution

Make the build date configurable via ldflags to allow reproducible builds.

Additional context

No response

Would you like to work on fixing this bug?

None

[kastl-ars]

Has this one gone unnoticed? No ideas, anyone?

[cratelyn]

@kastl-ars this has been noticed. it's not a change the team currently has prioritized, but we would welcome help and be happy to shepard someone along in implementing this!

[bmwiedemann]

This likely comes from https://github.com/shurcooL/vfsgen/blob/main/generator.go#L64 via multicluster/static/generate.go

[alpeb]

Addressed in #14206; will be available in edge-25.7.3

[kastl-ars]

Addressed in #14206; will be available in edge-25.7.3

Thanks a lot! I already packaged 25.7.3 for openSUSE, let's see what the reproducible checker scripts say... :-)

[alpeb]

@kastl-ars we had to temporarily revert that change, but it was finally included in edge-25.7.6 which was released yesterday 😅

[kastl-ars]

@kastl-ars we had to temporarily revert that change, but it was finally included in edge-25.7.6 which was released yesterday 😅

That explains why .3 was still found as non-reproducible. I'll update the package and we'll see what happens...

Thanks for the information, @alpeb !