jordansissel/fpm · error · FPM::InvalidPackageConfiguration

#{name}: ar is insufficient to support source_date_epoch.

Error message

#{name}: ar is insufficient to support source_date_epoch.

What it means

Deterministic deb output requires 'ar -D' (deterministic mode, zeroed timestamps/uids in the ar header). Before building, fpm probes the system ar (ar_cmd_deterministic?); if source_date_epoch is set and the ar in PATH does not support -D, it raises FPM::InvalidPackageConfiguration telling you binutils is too old or non-GNU.

Source

Thrown at lib/fpm/package/deb.rb:538

      end
      if !script?(:after_remove)
        logger.info("You gave --deb-shlibs but no --after-remove, so " \
                     "I am adding an after-remove script that runs " \
                     "ldconfig to update the system library cache")
        scripts[:after_remove] = template("deb/ldconfig.sh.erb").result(binding)
      end
    end

    if attributes[:source_date_epoch].nil? and not attributes[:source_date_epoch_default].nil?
      attributes[:source_date_epoch] = attributes[:source_date_epoch_default]
    end
    if attributes[:source_date_epoch] == "0"
      logger.error("Alas, ruby's Zlib::GzipWriter does not support setting an mtime of zero.  Aborting.")
      raise FPM::InvalidPackageConfiguration, "#{name}: source_date_epoch of 0 not supported."
    end
    if not attributes[:source_date_epoch].nil? and not ar_cmd_deterministic?
      logger.error("Alas, could not find an ar that can handle -D option. Try installing recent gnu binutils. Aborting.")
      raise FPM::InvalidPackageConfiguration, "#{name}: ar is insufficient to support source_date_epoch."
    end
    if not attributes[:source_date_epoch].nil? and not tar_cmd_supports_sort_names_and_set_mtime?
      logger.error("Alas, could not find a tar that can set mtime and sort.  Try installing recent gnu tar. Aborting.")
      raise FPM::InvalidPackageConfiguration, "#{name}: tar is insufficient to support source_date_epoch."
    end

    systemd_file_extensions = [
        ".service",
        ".socket",
        ".device",
        ".mount",
        ".automount",
        ".swap",
        ".target",
        ".path",
        ".timer",
        ".slice",
        ".scope",

View on GitHub (pinned to b6d77ba72a)

Solutions

1. Install recent GNU binutils and ensure 'ar' in PATH is GNU ar (ar --version shows 'GNU ar'); on alpine: apk add binutils
2. Check with: echo | ar -D rc /tmp/x.a - && ar -t /tmp/x.a as a quick capability probe
3. Drop reproducibility on this host by removing --source-date-epoch / unsetting SOURCE_DATE_EPOCH
4. Run the build in a container image that ships modern binutils (e.g. debian:stable)

Example fix

# before (busybox/old ar in PATH)
SOURCE_DATE_EPOCH=1 fpm -s dir -t deb -n foo .
# -> ar is insufficient to support source_date_epoch

# after
apk add binutils   # or apt-get install binutils
ar --version       # confirm 'GNU ar'
SOURCE_DATE_EPOCH=1 fpm -s dir -t deb -n foo .

def gnu_ar_deterministic?
  version = `ar --version 2>/dev/null`
  return false unless version.include?('GNU ar')
  system('ar -D rc /tmp/_probe.a /dev/null 2>/dev/null')
end

abort 'install GNU binutils ar (needs -D) or drop --source-date-epoch' unless gnu_ar_deterministic?

begin
  pkg.output(out)   # with attributes[:source_date_epoch] set
rescue FPM::InvalidPackageConfiguration => e
  raise unless e.message =~ /ar is insufficient/
  warn 'falling back to non-reproducible build: no GNU ar -D on this host'
  pkg.attributes[:source_date_epoch] = nil
  pkg.output(out)
end

When it happens

Trigger: Building a deb with --source-date-epoch (or SOURCE_DATE_EPOCH via the default attribute) on a host whose ar lacks -D: ancient GNU binutils (pre-2.20-era), some minimal containers (busybox ar), or a non-GNU ar first in PATH (old macOS/Xcode toolchains).

Common situations: Reproducible-build CI on minimal Docker base images (alpine/busybox) where ar is busybox; old enterprise distros (RHEL/CentOS 6 era); macOS build agents with legacy cctools; PATH shadowing GNU ar with a vendor ar.

Related errors

• #{name}: tar is insufficient to support source_date_epoch.
• #{name}: source_date_epoch of 0 not supported.
• deb compression value of '#{value}' is invalid. Must be one
• The version looks invalid for Debian packages. Debian versio
• Missing control.tar in deb source package #{package}

AI-assisted analysis of jordansissel/fpm@b6d77ba72a (2026-08-21). Data as JSON: /api/errors/38d9ab6fbcba1e1a. Report an issue: GitHub.