{"record":{"id":"38d9ab6fbcba1e1a","repo":"jordansissel/fpm","slug":"name-ar-is-insufficient-to-support-source-date","errorCode":null,"errorMessage":"#{name}: ar is insufficient to support source_date_epoch.","messagePattern":"#(.+?): ar is insufficient to support source_date_epoch\\.","errorType":"validation","errorClass":"FPM::InvalidPackageConfiguration","httpStatus":null,"severity":"error","filePath":"lib/fpm/package/deb.rb","lineNumber":538,"sourceCode":"      end\n      if !script?(:after_remove)\n        logger.info(\"You gave --deb-shlibs but no --after-remove, so \" \\\n                     \"I am adding an after-remove script that runs \" \\\n                     \"ldconfig to update the system library cache\")\n        scripts[:after_remove] = template(\"deb/ldconfig.sh.erb\").result(binding)\n      end\n    end\n\n    if attributes[:source_date_epoch].nil? and not attributes[:source_date_epoch_default].nil?\n      attributes[:source_date_epoch] = attributes[:source_date_epoch_default]\n    end\n    if attributes[:source_date_epoch] == \"0\"\n      logger.error(\"Alas, ruby's Zlib::GzipWriter does not support setting an mtime of zero.  Aborting.\")\n      raise FPM::InvalidPackageConfiguration, \"#{name}: source_date_epoch of 0 not supported.\"\n    end\n    if not attributes[:source_date_epoch].nil? and not ar_cmd_deterministic?\n      logger.error(\"Alas, could not find an ar that can handle -D option. Try installing recent gnu binutils. Aborting.\")\n      raise FPM::InvalidPackageConfiguration, \"#{name}: ar is insufficient to support source_date_epoch.\"\n    end\n    if not attributes[:source_date_epoch].nil? and not tar_cmd_supports_sort_names_and_set_mtime?\n      logger.error(\"Alas, could not find a tar that can set mtime and sort.  Try installing recent gnu tar. Aborting.\")\n      raise FPM::InvalidPackageConfiguration, \"#{name}: tar is insufficient to support source_date_epoch.\"\n    end\n\n    systemd_file_extensions = [\n        \".service\",\n        \".socket\",\n        \".device\",\n        \".mount\",\n        \".automount\",\n        \".swap\",\n        \".target\",\n        \".path\",\n        \".timer\",\n        \".slice\",\n        \".scope\",","sourceCodeStart":520,"sourceCodeEnd":556,"githubUrl":"https://github.com/jordansissel/fpm/blob/b6d77ba72a560b687723376a0e5115c3a92634ad/lib/fpm/package/deb.rb#L520-L556","documentation":"Deterministic deb output requires 'ar -D' (deterministic mode, zeroed timestamps/uids in the ar header). Before building, fpm probes the system ar (ar_cmd_deterministic?); if source_date_epoch is set and the ar in PATH does not support -D, it raises FPM::InvalidPackageConfiguration telling you binutils is too old or non-GNU.","triggerScenarios":"Building a deb with --source-date-epoch (or SOURCE_DATE_EPOCH via the default attribute) on a host whose ar lacks -D: ancient GNU binutils (pre-2.20-era), some minimal containers (busybox ar), or a non-GNU ar first in PATH (old macOS/Xcode toolchains).","commonSituations":"Reproducible-build CI on minimal Docker base images (alpine/busybox) where ar is busybox; old enterprise distros (RHEL/CentOS 6 era); macOS build agents with legacy cctools; PATH shadowing GNU ar with a vendor ar.","solutions":["Install recent GNU binutils and ensure 'ar' in PATH is GNU ar (ar --version shows 'GNU ar'); on alpine: apk add binutils","Check with: echo | ar -D rc /tmp/x.a - && ar -t /tmp/x.a as a quick capability probe","Drop reproducibility on this host by removing --source-date-epoch / unsetting SOURCE_DATE_EPOCH","Run the build in a container image that ships modern binutils (e.g. debian:stable)"],"exampleFix":"# before (busybox/old ar in PATH)\nSOURCE_DATE_EPOCH=1 fpm -s dir -t deb -n foo .\n# -> ar is insufficient to support source_date_epoch\n\n# after\napk add binutils   # or apt-get install binutils\nar --version       # confirm 'GNU ar'\nSOURCE_DATE_EPOCH=1 fpm -s dir -t deb -n foo .","handlingStrategy":"fallback","validationCode":"def gnu_ar_deterministic?\n  version = `ar --version 2>/dev/null`\n  return false unless version.include?('GNU ar')\n  system('ar -D rc /tmp/_probe.a /dev/null 2>/dev/null')\nend\n\nabort 'install GNU binutils ar (needs -D) or drop --source-date-epoch' unless gnu_ar_deterministic?","typeGuard":null,"tryCatchPattern":"begin\n  pkg.output(out)   # with attributes[:source_date_epoch] set\nrescue FPM::InvalidPackageConfiguration => e\n  raise unless e.message =~ /ar is insufficient/\n  warn 'falling back to non-reproducible build: no GNU ar -D on this host'\n  pkg.attributes[:source_date_epoch] = nil\n  pkg.output(out)\nend","preventionTips":["Install GNU binutils in build images and assert 'ar --version' reports GNU ar before reproducible builds","Avoid busybox-only base images for deterministic deb packaging; use glibc distro images","Probe tool capabilities (ar -D, tar --sort=name) in CI setup rather than at build time"],"tags":["fpm","deb","reproducible-builds","binutils","ar","toolchain","packaging"],"backgroundTag":"missing-build-tool-capability","analyzedSha":"b6d77ba72a560b687723376a0e5115c3a92634ad","analyzedAt":"2026-08-21T16:39:02.570Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}