{"record":{"id":"b037dd85ad2f2824","repo":"jordansissel/fpm","slug":"name-tar-is-insufficient-to-support-source-dat","errorCode":null,"errorMessage":"#{name}: tar is insufficient to support source_date_epoch.","messagePattern":"#(.+?): tar is insufficient to support source_date_epoch\\.","errorType":"validation","errorClass":"FPM::InvalidPackageConfiguration","httpStatus":null,"severity":"error","filePath":"lib/fpm/package/deb.rb","lineNumber":542,"sourceCode":"                     \"ldconfig to update the system library cache\")\n        scripts[:after_remove] = template(\"deb/ldconfig.sh.erb\").result(binding)\n      end\n    end\n\n    if attributes[:source_date_epoch].nil? and not attributes[:source_date_epoch_default].nil?\n      attributes[:source_date_epoch] = attributes[:source_date_epoch_default]\n    end\n    if attributes[:source_date_epoch] == \"0\"\n      logger.error(\"Alas, ruby's Zlib::GzipWriter does not support setting an mtime of zero.  Aborting.\")\n      raise FPM::InvalidPackageConfiguration, \"#{name}: source_date_epoch of 0 not supported.\"\n    end\n    if not attributes[:source_date_epoch].nil? and not ar_cmd_deterministic?\n      logger.error(\"Alas, could not find an ar that can handle -D option. Try installing recent gnu binutils. Aborting.\")\n      raise FPM::InvalidPackageConfiguration, \"#{name}: ar is insufficient to support source_date_epoch.\"\n    end\n    if not attributes[:source_date_epoch].nil? and not tar_cmd_supports_sort_names_and_set_mtime?\n      logger.error(\"Alas, could not find a tar that can set mtime and sort.  Try installing recent gnu tar. Aborting.\")\n      raise FPM::InvalidPackageConfiguration, \"#{name}: tar is insufficient to support source_date_epoch.\"\n    end\n\n    systemd_file_extensions = [\n        \".service\",\n        \".socket\",\n        \".device\",\n        \".mount\",\n        \".automount\",\n        \".swap\",\n        \".target\",\n        \".path\",\n        \".timer\",\n        \".slice\",\n        \".scope\",\n    ]\n\n    attributes[:deb_systemd] = []\n    attributes.fetch(:deb_systemd_list, []).each do |systemd|","sourceCodeStart":524,"sourceCodeEnd":560,"githubUrl":"https://github.com/jordansissel/fpm/blob/b6d77ba72a560b687723376a0e5115c3a92634ad/lib/fpm/package/deb.rb#L524-L560","documentation":"Deterministic deb output needs GNU tar's --sort=name and --mtime=@N options to normalize file order and timestamps. When source_date_epoch is set, fpm probes tar (tar_cmd_supports_sort_names_and_set_mtime?) and, if the system tar cannot do both, raises FPM::InvalidPackageConfiguration recommending a recent GNU tar.","triggerScenarios":"Building a deb with --source-date-epoch on hosts whose tar is busybox tar (alpine/minimal containers), BSD tar masquerading as tar, or GNU tar older than ~1.26 (no --sort option). The probe fails and the build aborts before creating data.tar.","commonSituations":"alpine-based CI images without GNU tar installed; macOS agents where /usr/bin/tar is bsdtar; very old RHEL/CentOS images; PATH preferring a vendor tar over /usr/gnu/bin/tar.","solutions":["Install GNU tar and make sure it resolves first: alpine 'apk add tar' (GNU), debian 'apt-get install tar'; verify with tar --version","On macOS, brew install gnu-tar and put gnutar first in PATH","Drop --source-date-epoch / unset SOURCE_DATE_EPOCH if reproducibility is not required for this build","Use a standard glibc-based build container (debian/ubuntu) for reproducible package builds"],"exampleFix":"# before (busybox/bsdtar in PATH)\nSOURCE_DATE_EPOCH=1 fpm -s dir -t deb -n foo .\n# -> tar is insufficient to support source_date_epoch\n\n# after (alpine)\napk add tar\ntar --version    # GNU tar\nSOURCE_DATE_EPOCH=1 fpm -s dir -t deb -n foo .","handlingStrategy":"fallback","validationCode":"def tar_supports_determinism?\n  v = `tar --version 2>/dev/null`\n  return false unless v.include?('GNU tar')\n  system('tar --sort=name --mtime=@1 -cf /dev/null /dev/null 2>/dev/null')\nend\n\nabort 'install recent GNU tar (--sort=name/--mtime) or drop --source-date-epoch' unless tar_supports_determinism?","typeGuard":null,"tryCatchPattern":"begin\n  pkg.output(out)   # with attributes[:source_date_epoch] set\nrescue FPM::InvalidPackageConfiguration => e\n  raise unless e.message =~ /tar is insufficient/\n  warn 'no deterministic GNU tar on host; building without source_date_epoch'\n  pkg.attributes[:source_date_epoch] = nil\n  pkg.output(out)\nend","preventionTips":["Install GNU tar in build images; on alpine 'apk add tar', on macOS 'brew install gnu-tar'","Verify 'tar --version' says GNU tar before running reproducible deb builds","Keep a non-reproducible fallback path in pipelines for hosts lacking GNU tools, with an explicit warning"],"tags":["fpm","deb","reproducible-builds","tar","toolchain","packaging"],"backgroundTag":"missing-build-tool-capability","analyzedSha":"b6d77ba72a560b687723376a0e5115c3a92634ad","analyzedAt":"2026-08-21T16:39:02.570Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}