Merge pull request #2947 from Hamza0101/reproducible-export-dates

Exports: SOURCE_DATE_EPOCH stands in for the clock, so output repeats

crates/doc/src/metadata.rs

@@ -82,6 +82,25 @@ impl DocMetadata {
     }
 }
 
+/// The time exported files record: PDF `CreationDate` and `ModDate`, the PNG `Creation Time`
+/// entry, a zip entry's date, and a saved document's `created` and `modified`. It is the clock,
+/// unless `SOURCE_DATE_EPOCH` is set, which replaces it so that the same commands produce the same
+/// bytes twice (#2880).
+///
+/// The raw clock stays in [`now_unix`], which is what a heartbeat is judged by and what seeds
+/// encryption: neither may be pinned by the environment.
+pub fn output_time() -> Option<i64> {
+    stamp_from_env(|n| std::env::var(n).ok()).or_else(now_unix)
+}
+
+/// `SOURCE_DATE_EPOCH` as Unix seconds: the reproducible-builds variable
+/// (<https://reproducible-builds.org/specs/source-date-epoch/>), a non-negative decimal integer of
+/// seconds since the epoch. `None` when it is unset, blank, negative or not an integer, and then
+/// the clock decides — an export is never refused over the environment.
+fn stamp_from_env(get: impl Fn(&str) -> Option<String>) -> Option<i64> {
+    get("SOURCE_DATE_EPOCH")?.trim().parse::<i64>().ok().filter(|t| *t >= 0)
+}
+
 /// The current time as Unix seconds (UTC); `None` where the platform has no clock (the web build).
 #[cfg(not(target_arch = "wasm32"))]
 pub fn now_unix() -> Option<i64> {
@@ -148,4 +167,21 @@ mod tests {
         );
         assert!(DocMetadata::default().png_text("").is_empty());
     }
+
+    /// `SOURCE_DATE_EPOCH` replaces the clock in exported output only when it is a non-negative
+    /// decimal integer; anything else leaves the clock to decide, so an export is never refused.
+    #[test]
+    fn source_date_epoch_is_read_only_as_a_non_negative_integer() {
+        let env = |v: Option<&'static str>| move |n: &str| v.filter(|_| n == "SOURCE_DATE_EPOCH").map(str::to_owned);
+        assert_eq!(stamp_from_env(env(Some("1791208980"))), Some(1_791_208_980));
+        assert_eq!(stamp_from_env(env(Some("0"))), Some(0));
+        assert_eq!(stamp_from_env(env(Some("  1791208980  "))), Some(1_791_208_980));
+        for bad in ["", "   ", "-1", "later", "1791208980.5", "1e9", "99999999999999999999"] {
+            assert_eq!(stamp_from_env(env(Some(bad))), None, "{bad:?}");
+        }
+        assert_eq!(stamp_from_env(env(None)), None, "unset");
+        // Another variable never stands in for it.
+        assert_eq!(stamp_from_env(|_| Some("1791208980".to_owned())), Some(1_791_208_980));
+        assert_eq!(stamp_from_env(|n: &str| (n == "TZ").then(|| "1791208980".to_owned())), None);
+    }
 }

crates/engine/src/cmd/fileio/eps.rs

@@ -278,7 +278,7 @@ pub(super) fn encode(doc: &Document, p: &Value) -> Result<Encoded> {
     if transparent && flat.is_some() {
         enc.warnings.push("transparency is flattened into opaque art and images (EPS has none): see the flattener preset".into());
     }
-    let created = vectorcraft_doc::metadata::now_unix();
+    let created = vectorcraft_doc::metadata::output_time();
     let mut renderer = vectorcraft_render::Renderer::new();
     for (board, region, origin) in pages {
         let rect = vectorcraft_eps::preview_rect(region, origin);

crates/engine/src/cmd/fileio/legacy_ai.rs

@@ -110,7 +110,7 @@ pub(super) fn encode(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result
     if boards.len() > 1 {
         enc.warnings.push(SEPARATE.to_string());
     }
-    let created = vectorcraft_doc::metadata::now_unix();
+    let created = vectorcraft_doc::metadata::output_time();
     let failed = vectorcraft_render::decode_failures();
     for b in boards {
         let one = super::save::artboard_doc(doc, b);

crates/engine/src/cmd/fileio/pdf.rs

@@ -242,7 +242,7 @@ pub fn expand_preset<'a>(s: &Session, cmd: &str, p: &'a Value) -> Result<Cow<'a,
 pub fn options(cmd: &str, doc: &Document, p: &Value) -> Result<PdfOptions> {
     let pick = if p.is_object() { ArtboardPick::deserialize(p).map_err(|e| bad(cmd, format!("PDF options: {e}")))? } else { ArtboardPick::default() };
     let artboards = pick.resolve(doc.artboards.len()).map_err(|e| bad(cmd, e))?;
-    let now = vectorcraft_doc::metadata::now_unix();
+    let now = vectorcraft_doc::metadata::output_time();
     Ok(PdfOptions { settings: settings(cmd, p)?, artboards, created: doc.metadata.created.or(now), modified: now, ..Default::default() })
 }
 

crates/engine/src/cmd/fileio/screens.rs

@@ -387,7 +387,7 @@ impl<'a> Naming<'a> {
         let prefix = file_part(o.prefix.as_deref().unwrap_or(""));
         let when = match o.date.as_deref() {
             Some(d) => naming::parse_date(d).ok_or_else(|| bad(C, format!("date `{d}`: YYYY-MM-DD")))?,
-            None => vectorcraft_doc::metadata::now_unix().map_or([1970, 1, 1, 0, 0, 0], vectorcraft_doc::metadata::civil),
+            None => vectorcraft_doc::metadata::output_time().map_or([1970, 1, 1, 0, 0, 0], vectorcraft_doc::metadata::civil),
         };
         let per_file = match o.counter_per.as_deref() {
             None | Some("item") => false,

crates/engine/src/cmd/mod.rs

@@ -500,7 +500,7 @@ pub(crate) fn date_param(p: &Value, key: &str, cmd: &str) -> Result<Option<Optio
 /// no clock). It joins the running command's journal entry as `key`, so a replay of the journal
 /// gives the same date whenever it runs (an action leaves it out: [`crate::Session::journal_for_action`]).
 pub(crate) fn clock_date(s: &mut Session, key: &str, given: Option<Option<i64>>) -> Option<i64> {
-    let t = given.unwrap_or_else(vectorcraft_doc::metadata::now_unix);
+    let t = given.unwrap_or_else(vectorcraft_doc::metadata::output_time);
     s.note_journal(key, serde_json::json!(t));
     t
 }

crates/engine/src/cmd/package.rs

@@ -400,7 +400,7 @@ fn check_no_overwrite(root: &Path, entries: &[Entry], sources: &[&str]) -> Resul
 
 /// The MS-DOS time and date a zip entry records: now (UTC), else 1980-01-01.
 fn dos_time() -> (u16, u16) {
-    let Some(t) = vectorcraft_doc::metadata::now_unix() else { return (0, 0x21) };
+    let Some(t) = vectorcraft_doc::metadata::output_time() else { return (0, 0x21) };
     let [y, mo, d, h, mi, s] = vectorcraft_doc::metadata::civil(t);
     let date = (((y - 1980).clamp(0, 127) << 9) | (mo << 5) | d) as u16;
     (((h << 11) | (mi << 5) | (s / 2)) as u16, date)

crates/engine/src/tests_fileinfo.rs

@@ -175,9 +175,9 @@ fn assert_dated(bytes: &[u8], created: std::ops::RangeInclusive<i64>, modified:
 
 /// Run `f` → (its result, the time of writing: the Unix seconds before and after it).
 fn written<T>(f: impl FnOnce() -> T) -> (T, std::ops::RangeInclusive<i64>) {
-    let before = vectorcraft_doc::metadata::now_unix().unwrap();
+    let before = vectorcraft_doc::metadata::output_time().unwrap();
     let out = f();
-    (out, before..=vectorcraft_doc::metadata::now_unix().unwrap())
+    (out, before..=vectorcraft_doc::metadata::output_time().unwrap())
 }
 
 #[test]

crates/engine/src/tests_nativefile.rs

@@ -160,3 +160,20 @@ fn newer_keys_and_legacy_profiles_survive_open_and_save() {
     let v2 = json_of(&saved(&mut s, json!({"version": 2})));
     assert_eq!(v2["document"]["unknown"]["colorProfiles"]["rgb"], "sRGB IEC61966-2.1");
 }
+
+/// A save records the date the document was made in, so the same commands twice gave different
+/// bytes (#2880). A pinned date makes them identical — `file.new {created}` here, and
+/// `SOURCE_DATE_EPOCH` for an export that takes no date param.
+#[test]
+fn a_pinned_date_makes_saves_byte_identical() {
+    let once = |t: i64| {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 400, "height": 200, "created": t})).unwrap();
+        s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 100, "height": 50})).unwrap();
+        saved(&mut s, json!({}))
+    };
+    let at = 1_791_208_980;
+    assert_eq!(once(at), once(at), "the same document and date give the same bytes");
+    // The date really is in the bytes, so the comparison above is not vacuous.
+    assert_ne!(once(at), once(at + 1), "another date shows in the bytes");
+}

crates/pdf/src/export.rs

@@ -70,7 +70,7 @@ fn export_with_report_inner(doc: &Document, opts: &PdfOptions, left_out: &mut Ha
 
     let title = crate::pdfx::title(set.standard, opts.title.clone().unwrap_or_else(|| doc.title.clone()));
     // The time of writing (none on the web) dates the editing data and the page information.
-    let now = vectorcraft_doc::metadata::now_unix();
+    let now = vectorcraft_doc::metadata::output_time();
     let created_at = opts.created.or(now);
     crate::pdfx::require_date(set.standard, created_at)?;
     let mut w = Writer::new(doc, set, &title, created_at, doc.color_mode == vectorcraft_doc::ColorMode::Cmyk)?;

crates/pdf/src/print/mod.rs

@@ -355,7 +355,7 @@ pub fn plan<'a>(doc: &'a Document, opts: &PrintOptions) -> Result<PrintPlan<'a>,
     let set = &opts.settings;
     let job = Job::new(doc, set, opts.postscript)?;
     let title = opts.title.clone().unwrap_or_else(|| job.doc.title.clone());
-    let created = opts.created.or_else(vectorcraft_doc::metadata::now_unix);
+    let created = opts.created.or_else(vectorcraft_doc::metadata::output_time);
     let sep = Separator::new(&job.doc, set);
     let plates: Vec<Document> = (0..job.plates.len()).filter_map(|p| job.ink(Some(p))).map(|i| sep.plate(&i.name)).collect();
     let marks = set.marks.printer_marks();

crates/pdf/src/tests_editing.rs

@@ -53,9 +53,9 @@ fn the_native_document_comes_back_intact() {
 fn the_native_documents_modification_date_is_the_time_of_writing() {
     // Created in 1970: the information dictionary's dates say so, the embedded file's doesn't.
     let year = |t: Option<i64>| vectorcraft_doc::metadata::civil(t.unwrap())[0];
-    let before = year(vectorcraft_doc::metadata::now_unix());
+    let before = year(vectorcraft_doc::metadata::output_time());
     let text = String::from_utf8_lossy(&pdf_with(Some(b"native"), false).bytes).into_owned();
-    let after = year(vectorcraft_doc::metadata::now_unix());
+    let after = year(vectorcraft_doc::metadata::output_time());
     assert!(text.contains("/CreationDate(D:1970"), "the file's creation date");
     assert!([before, after].iter().any(|y| text.contains(&format!("/ModDate(D:{y:04}"))), "the embedded file is dated when it is written");
 }

crates/pdf/src/tests_marks.rs

@@ -229,7 +229,7 @@ fn page_information_prints_the_time_of_the_export_not_the_creation_date() {
         });
         out
     };
-    let now = || vectorcraft_doc::metadata::now_unix().unwrap();
+    let now = || vectorcraft_doc::metadata::output_time().unwrap();
     // Both print the minute they are written in: try again when the minute turns between them.
     for _ in 0..3 {
         let minute = now() / 60;

crates/ui-egui/src/tests_sysclip.rs

@@ -398,13 +398,13 @@ fn the_worker_makes_the_formats_the_session_makes() {
     // to another second since the Copy, they are compared again after another Copy.
     let check = |app: &mut VectorcraftApp, what: &str, mimes: &[&str]| {
         for _ in 0..100 {
-            let second = vectorcraft_doc::metadata::now_unix();
+            let second = vectorcraft_doc::metadata::output_time();
             run(app, "edit.copy", json!({}));
             assert_eq!(app.background.jobs.len(), 1, "{what}: made on the worker");
             background::wait_all(app);
             assert_eq!(written(&board), mimes, "{what}");
             let session = app.session.clipboard_flavours();
-            let dated = mimes.contains(&PDF) && vectorcraft_doc::metadata::now_unix() != second;
+            let dated = mimes.contains(&PDF) && vectorcraft_doc::metadata::output_time() != second;
             if board.borrow().flavours == session || !dated {
                 assert_eq!(board.borrow().flavours, session, "{what}");
                 return;

docs/mcp.md

@@ -821,6 +821,25 @@ Not remembered: Color Settings, the document, anything else. Nothing is read or
 desktop app starts, the presets it kept in its preferences file before this folder existed are moved into it; after
 that the folder is the one place they live, so a preset deleted by `vectorcraft-cli` is gone in the app too.
 
+### Reproducible output
+
+PNG, PDF, EPS, legacy `.ai`, packaged zips and saved `.vectorcraft` files record the time they were
+made in (PDF `CreationDate` and `ModDate`, the PNG `Creation Time` entry, a zip entry's date, a
+document's `created` and `modified`), so the same commands run twice gave different bytes though the
+pixels matched (#2880). Setting **`SOURCE_DATE_EPOCH`** to a non-negative whole number of seconds
+since the epoch records that instant instead of the clock, and the bytes repeat
+(<https://reproducible-builds.org/specs/source-date-epoch/>):
+
+```sh
+SOURCE_DATE_EPOCH=1791208980 vectorcraft-cli run --cmd file.new --params '{}' --export out.pdf
+```
+
+A command that takes its own date (`file.new {created}`, a save's `modified`) still wins over the
+variable. A blank, negative or non-numeric value is ignored and the clock decides, so an export is
+never refused over the environment. The variable does not reach the recovery heartbeat or the
+random seed PDF encryption draws on, which must follow the real clock. SVG output carries no time
+and was already reproducible.
+
 ### Parameter keys
 
 `command_run`, each step of `command_batch`, `run --cmd … --params` and the control channel's `engine.execute` check