jordansissel/fpm · error · FPM::InvalidPackageConfiguration

#{name}: tar is insufficient to support source_date_epoch.

Error message

#{name}: tar is insufficient to support source_date_epoch.

What it means

Deterministic deb output needs GNU tar's --sort=name and --mtime=@N options to normalize file order and timestamps. When source_date_epoch is set, fpm probes tar (tar_cmd_supports_sort_names_and_set_mtime?) and, if the system tar cannot do both, raises FPM::InvalidPackageConfiguration recommending a recent GNU tar.

Source

Thrown at lib/fpm/package/deb.rb:542

                     "ldconfig to update the system library cache")
        scripts[:after_remove] = template("deb/ldconfig.sh.erb").result(binding)
      end
    end

    if attributes[:source_date_epoch].nil? and not attributes[:source_date_epoch_default].nil?
      attributes[:source_date_epoch] = attributes[:source_date_epoch_default]
    end
    if attributes[:source_date_epoch] == "0"
      logger.error("Alas, ruby's Zlib::GzipWriter does not support setting an mtime of zero.  Aborting.")
      raise FPM::InvalidPackageConfiguration, "#{name}: source_date_epoch of 0 not supported."
    end
    if not attributes[:source_date_epoch].nil? and not ar_cmd_deterministic?
      logger.error("Alas, could not find an ar that can handle -D option. Try installing recent gnu binutils. Aborting.")
      raise FPM::InvalidPackageConfiguration, "#{name}: ar is insufficient to support source_date_epoch."
    end
    if not attributes[:source_date_epoch].nil? and not tar_cmd_supports_sort_names_and_set_mtime?
      logger.error("Alas, could not find a tar that can set mtime and sort.  Try installing recent gnu tar. Aborting.")
      raise FPM::InvalidPackageConfiguration, "#{name}: tar is insufficient to support source_date_epoch."
    end

    systemd_file_extensions = [
        ".service",
        ".socket",
        ".device",
        ".mount",
        ".automount",
        ".swap",
        ".target",
        ".path",
        ".timer",
        ".slice",
        ".scope",
    ]

    attributes[:deb_systemd] = []
    attributes.fetch(:deb_systemd_list, []).each do |systemd|

View on GitHub (pinned to b6d77ba72a)

Solutions

1. Install GNU tar and make sure it resolves first: alpine 'apk add tar' (GNU), debian 'apt-get install tar'; verify with tar --version
2. On macOS, brew install gnu-tar and put gnutar first in PATH
3. Drop --source-date-epoch / unset SOURCE_DATE_EPOCH if reproducibility is not required for this build
4. Use a standard glibc-based build container (debian/ubuntu) for reproducible package builds

Example fix

# before (busybox/bsdtar in PATH)
SOURCE_DATE_EPOCH=1 fpm -s dir -t deb -n foo .
# -> tar is insufficient to support source_date_epoch

# after (alpine)
apk add tar
tar --version    # GNU tar
SOURCE_DATE_EPOCH=1 fpm -s dir -t deb -n foo .

def tar_supports_determinism?
  v = `tar --version 2>/dev/null`
  return false unless v.include?('GNU tar')
  system('tar --sort=name --mtime=@1 -cf /dev/null /dev/null 2>/dev/null')
end

abort 'install recent GNU tar (--sort=name/--mtime) or drop --source-date-epoch' unless tar_supports_determinism?

begin
  pkg.output(out)   # with attributes[:source_date_epoch] set
rescue FPM::InvalidPackageConfiguration => e
  raise unless e.message =~ /tar is insufficient/
  warn 'no deterministic GNU tar on host; building without source_date_epoch'
  pkg.attributes[:source_date_epoch] = nil
  pkg.output(out)
end

When it happens

Trigger: Building a deb with --source-date-epoch on hosts whose tar is busybox tar (alpine/minimal containers), BSD tar masquerading as tar, or GNU tar older than ~1.26 (no --sort option). The probe fails and the build aborts before creating data.tar.

Common situations: alpine-based CI images without GNU tar installed; macOS agents where /usr/bin/tar is bsdtar; very old RHEL/CentOS images; PATH preferring a vendor tar over /usr/gnu/bin/tar.

Related errors

• #{name}: ar is insufficient to support source_date_epoch.
• #{name}: source_date_epoch of 0 not supported.
• deb compression value of '#{value}' is invalid. Must be one
• The version looks invalid for Debian packages. Debian versio
• Missing control.tar in deb source package #{package}

AI-assisted analysis of jordansissel/fpm@b6d77ba72a (2026-08-21). Data as JSON: /api/errors/b037dd85ad2f2824. Report an issue: GitHub.