Windows import libraries are not reproducible

[giordano]

JuliaPackaging/BinaryBuilderBase.jl#277 fixed a problem with reproducibility of object files on Windows, but import libraries are still non-reproducible, likely because of some other timestamps embedded in the archives

% julia --compile=min -e 'using BinaryBuilder.BinaryBuilderBase; BinaryBuilderBase.runshell(Platform("x86_64", "windows"))'
sandbox:${WORKSPACE} # echo 'int foo(){ return 42; }' | cc -x c -shared - -o libfoo.${dlext} -Wl,--out-implib,libfoo.${dlext}.a
sandbox:${WORKSPACE} # sha256sum libfoo.dll libfoo.dll.a 
27b39718304708ca6e58e21982b1a480954066724131f2d5b1dde6bccb1c9897  libfoo.dll
228ba90b48c824ac1159492bb3f4105f5df45e6fe054b04fe6d75a8ee8749089  libfoo.dll.a
sandbox:${WORKSPACE} # echo 'int foo(){ return 42; }' | cc -x c -shared - -o libfoo.${dlext} -Wl,--out-implib,libfoo.${dlext}.a
sandbox:${WORKSPACE} # sha256sum libfoo.dll libfoo.dll.a 
27b39718304708ca6e58e21982b1a480954066724131f2d5b1dde6bccb1c9897  libfoo.dll
f331c2195481db5f6a1211e942cd9950ac94ea9caa939a1e7890fdb6fb6f8faf  libfoo.dll.a
sandbox:${WORKSPACE} # echo 'int foo(){ return 42; }' | cc -x c -shared - -o libfoo.${dlext} -Wl,--out-implib,libfoo.${dlext}.a
sandbox:${WORKSPACE} # sha256sum libfoo.dll libfoo.dll.a 
27b39718304708ca6e58e21982b1a480954066724131f2d5b1dde6bccb1c9897  libfoo.dll
e59c1a613f7b0fdd000c2579e613853d3fc5dd9c9aa812bf04e1fa5ece1efe46  libfoo.dll.a
sandbox:${WORKSPACE} # echo 'int foo(){ return 42; }' | cc -x c -shared - -o libfoo.${dlext} -Wl,--out-implib,libfoo.${dlext}.a && ${target}-objdump -x libfoo.dll.a > objdump-1.log
sandbox:${WORKSPACE} # echo 'int foo(){ return 42; }' | cc -x c -shared - -o libfoo.${dlext} -Wl,--out-implib,libfoo.${dlext}.a && ${target}-objdump -x libfoo.dll.a > objdump-2.log
sandbox:${WORKSPACE} # diff -u objdump-1.log objdump-2.log 
--- objdump-1.log
+++ objdump-2.log
@@ -1,7 +1,7 @@
 In archive libfoo.dll.a:
 
 d000002.o:     file format pe-x86-64
-rw-r--r-- 0/0    261 Nov  7 22:36 2022 d000002.o
+rw-r--r-- 0/0    261 Nov  7 22:37 2022 d000002.o
 architecture: i386:x86-64, flags 0x00000038:
 HAS_DEBUG, HAS_SYMS, HAS_LOCALS
 start address 0x0000000000000000
@@ -76,7 +76,7 @@
 
 
 d000000.o:     file format pe-x86-64
-rw-r--r-- 0/0    318 Nov  7 22:36 2022 d000000.o
+rw-r--r-- 0/0    318 Nov  7 22:37 2022 d000000.o
 architecture: i386:x86-64, flags 0x00000039:
 HAS_RELOC, HAS_DEBUG, HAS_SYMS, HAS_LOCALS
 start address 0x0000000000000000
@@ -158,7 +158,7 @@
 
 
 d000001.o:     file format pe-x86-64
-rw-r--r-- 0/0    471 Nov  7 22:36 2022 d000001.o
+rw-r--r-- 0/0    471 Nov  7 22:37 2022 d000001.o
 architecture: i386:x86-64, flags 0x00000039:
 HAS_RELOC, HAS_DEBUG, HAS_SYMS, HAS_LOCALS
 start address 0x0000000000000000

[giordano]

If I understand correctly the source code of ld, for creating the import library it uses a built-in archiver, which doesn't call out to ar: https://github.com/bminor/binutils-gdb/blob/2f008f0640923fa307fdd73b229f951e64a1574b/ld/pe-dll.c#L2871-L3036 (or https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=ld/pe-dll.c;h=df16e85bbe0763b7fd3f8d50e8cec86e4c35b251;hb=HEAD#l2871-L3036). I'm not sure there is an easy solution for this.

[giordano]

As far as I understand, the file information about the object files is written in the import library with something like this:

/      1674301251  0     0     644     286       `

where 1674301251 is the Unix timestamp, 644 are the Unix file permissions, 286 is the file size. I wonder if we can run an audit pass which normalises the timestamp.