Bug 16152

Summary: Single file downloads in SRC_URI cause inconsistent source date epoch values and non-reproducible builds
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Joshua Watt <JPEWhacker>
Component: coreAssignee: Unassigned <unassigned>
Status: NEW --- QA Contact:
Severity: normal    
Priority: Medium CC: ccasciato, meta.mr.watcher, meta.watcher, randy.macleod, ross.burton
Version: 6.1   
Target Milestone: 6.1   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Joshua Watt 2026-01-26 18:02:08 UTC 
If a recipe downloads a bare file in SRC_URI (i.e. not a tarball), and doesn't download a git repo, the source date epoch can be inconsistent. This can particularly happen if the file ends up in a pre-mirror. The reason is that the reproducible code falls to get_source_date_epoch_from_youngest_file(), and this date will likely be the date of the downloaded file. Note that this generally doesn't affect file:// SRC_URI values, because their mtime is fixed.

The fix is probably that get_source_date_epoch_from_youngest_file should detect single file downloads (e.g. non-tarball files) and skip itself, allowing SOURCE_DATE_EPOCH_FALLBACK to be used instead. Alternatively, get_source_date_epoch_from_youngest_file might be able to be completely removed, although it does provide value for the common case of downloading a tarball.
Comment 1 Randy MacLeod 2026-05-28 13:16:30 UTC 
Bulk move of 6.0 Medium bugs to 6.1.