Add SOURCE_DATE_EPOCH support when building packages

src/poetry/core/masonry/builders/sdist.py

@@ -68,7 +68,7 @@ def build(
 
         name = distribution_name(self._package.name)
         target = target_dir / f"{name}-{self._meta.version}.tar.gz"
-        gz = GzipFile(target.as_posix(), mode="wb", mtime=0)
+        gz = GzipFile(target.as_posix(), mode="wb", mtime=self._get_archive_mtime())
         tar = tarfile.TarFile(
             target.as_posix(), mode="w", fileobj=gz, format=tarfile.PAX_FORMAT
         )
@@ -93,26 +93,25 @@ def build(
 
             if self._poetry.package.build_should_generate_setup():
                 setup = self.build_setup()
-                tar_info = tarfile.TarInfo(pjoin(tar_dir, "setup.py"))
-                tar_info.size = len(setup)
-                tar_info.mtime = 0
-                tar_info = self.clean_tarinfo(tar_info)
-                tar.addfile(tar_info, BytesIO(setup))
+                self.add_file_to_tar(tar, pjoin(tar_dir, "setup.py"), setup)
 
             pkg_info = self.build_pkg_info()
-
-            tar_info = tarfile.TarInfo(pjoin(tar_dir, "PKG-INFO"))
-            tar_info.size = len(pkg_info)
-            tar_info.mtime = 0
-            tar_info = self.clean_tarinfo(tar_info)
-            tar.addfile(tar_info, BytesIO(pkg_info))
+            self.add_file_to_tar(tar, pjoin(tar_dir, "PKG-INFO"), pkg_info)
         finally:
             tar.close()
             gz.close()
 
         logger.info(f"Built <comment>{target.name}</comment>")
         return target
 
+    def add_file_to_tar(
+        self, tar: tarfile.TarFile, file_name: str, content: bytes
+    ) -> None:
+        tar_info = tarfile.TarInfo(file_name)
+        tar_info.size = len(content)
+        tar_info = self.clean_tarinfo(tar_info)
+        tar.addfile(tar_info, BytesIO(content))
+
     def build_setup(self) -> bytes:
         from poetry.core.masonry.utils.package_include import PackageInclude
 
@@ -399,8 +398,7 @@ def convert_dependencies(
 
         return main, dict(extras)
 
-    @classmethod
-    def clean_tarinfo(cls, tar_info: TarInfo) -> TarInfo:
+    def clean_tarinfo(self, tar_info: TarInfo) -> TarInfo:
         """
         Clean metadata from a TarInfo object to make it more reproducible.
 
@@ -416,6 +414,20 @@ def clean_tarinfo(cls, tar_info: TarInfo) -> TarInfo:
         ti.gid = 0
         ti.uname = ""
         ti.gname = ""
+        ti.mtime = self._get_archive_mtime()
         ti.mode = normalize_file_permissions(ti.mode)
 
         return ti
+
+    @staticmethod
+    def _get_archive_mtime() -> int:
+        if source_date_epoch := os.getenv("SOURCE_DATE_EPOCH"):
+            try:
+                return int(source_date_epoch)
+            except ValueError:
+                logger.info(
+                    "SOURCE_DATE_EPOCH environment variable is not an int, using mtime=0"
+                )
+                return 0
+        logger.info("SOURCE_DATE_EPOCH environment variable is not set, using mtime=0")
+        return 0

src/poetry/core/masonry/builders/wheel.py

@@ -33,11 +33,14 @@
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
+    from typing import Tuple
 
     from packaging.utils import NormalizedName
 
     from poetry.core.poetry import Poetry
 
+    ZipInfoTimestamp = Tuple[int, int, int, int, int, int]
+
 wheel_file_template = """\
 Wheel-Version: 1.0
 Generator: poetry-core {version}
@@ -445,7 +448,7 @@ def _add_file(
     ) -> None:
         # We always want to have /-separated paths in the zip file and in RECORD
         rel_path_name = rel_path.as_posix()
-        zinfo = zipfile.ZipInfo(rel_path_name)
+        zinfo = zipfile.ZipInfo(rel_path_name, self._get_zipfile_date_time())
 
         # Normalize permission bits to either 755 (executable) or 644
         st_mode = full_path.stat().st_mode
@@ -478,10 +481,7 @@ def _write_to_zip(
         sio = StringIO()
         yield sio
 
-        # The default is a fixed timestamp rather than the current time, so
-        # that building a wheel twice on the same computer can automatically
-        # give you the exact same result.
-        date_time = (2016, 1, 1, 0, 0, 0)
+        date_time = self._get_zipfile_date_time()
         zi = zipfile.ZipInfo(rel_path, date_time)
         zi.external_attr = (0o644 & 0xFFFF) << 16  # Unix attributes
         b = sio.getvalue().encode("utf-8")
@@ -491,6 +491,30 @@ def _write_to_zip(
         wheel.writestr(zi, b, compress_type=zipfile.ZIP_DEFLATED)
         self._records.append((rel_path, hash_digest, len(b)))
 
+    @staticmethod
+    def _get_zipfile_date_time() -> ZipInfoTimestamp:
+        import time
+
+        default = (2016, 1, 1, 0, 0, 0)
+        try:
+            _env_date = time.gmtime(int(os.environ["SOURCE_DATE_EPOCH"]))[:6]
+        except (ValueError, KeyError):
+            # The default is a fixed timestamp rather than the current time, so
+            # that building a wheel twice on the same computer can automatically
+            # give you the exact same result.
+            logger.info(
+                "SOURCE_DATE_EPOCH environment variable not set or value is not an int, setting zipinfo date to default=%s",
+                default,
+            )
+            return default
+        else:
+            if _env_date[0] < 1980:
+                logger.info(
+                    "zipinfo date can't be earlier than 1980, setting zipinfo date to default=%s",
+                    default,
+                )
+            return _env_date
+
     def _write_entry_points(self, fp: TextIO) -> None:
         """
         Write entry_points.txt.

tests/masonry/builders/test_sdist.py

@@ -25,6 +25,7 @@
 
 
 if TYPE_CHECKING:
+    from _pytest.monkeypatch import MonkeyPatch
     from pytest_mock import MockerFixture
 
 fixtures_dir = Path(__file__).parent / "fixtures"
@@ -514,26 +515,6 @@ def get_ignored_files(self, folder: Path | None = None) -> list[str]:
 
     assert sdist.exists()
 
-    with tarfile.open(str(sdist), "r") as tar:
-        names = tar.getnames()
-        assert len(names) == len(set(names))
-        assert "my_package-1.2.3/LICENSE" in names
-        assert "my_package-1.2.3/README.rst" in names
-        assert "my_package-1.2.3/my_package/__init__.py" in names
-        assert "my_package-1.2.3/my_package/data/data1.txt" in names
-        assert "my_package-1.2.3/pyproject.toml" in names
-        assert "my_package-1.2.3/PKG-INFO" in names
-        # all last modified times should be set to a valid timestamp
-        for tarinfo in tar.getmembers():
-            if tarinfo.name in [
-                "my_package-1.2.3/setup.py",
-                "my_package-1.2.3/PKG-INFO",
-            ]:
-                # generated files have timestamp set to 0
-                assert tarinfo.mtime == 0
-                continue
-            assert tarinfo.mtime > 0
-
 
 def test_src_excluded_nested_data() -> None:
     module_path = fixtures_dir / "exclude_nested_data_toml"
@@ -710,3 +691,34 @@ def test_split_source() -> None:
     ns: dict[str, Any] = {}
     exec(compile(setup_ast, filename="setup.py", mode="exec"), ns)
     assert "" in ns["package_dir"] and "module_b" in ns["package_dir"]
+
+
+def test_sdist_members_mtime_default() -> None:
+    poetry = Factory().create_poetry(project("module1"))
+
+    builder = SdistBuilder(poetry)
+    builder.build()
+
+    sdist = fixtures_dir / "module1" / "dist" / "module1-0.1.tar.gz"
+
+    assert sdist.exists()
+
+    with tarfile.open(str(sdist), "r") as tar:
+        for tarinfo in tar.getmembers():
+            assert tarinfo.mtime == 0
+
+
+def test_sdist_mtime_set_from_envvar(monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.setenv("SOURCE_DATE_EPOCH", "1727883000")
+    poetry = Factory().create_poetry(project("module1"))
+
+    builder = SdistBuilder(poetry)
+    builder.build()
+
+    sdist = fixtures_dir / "module1" / "dist" / "module1-0.1.tar.gz"
+
+    assert sdist.exists()
+
+    with tarfile.open(str(sdist), "r") as tar:
+        for tarinfo in tar.getmembers():
+            assert tarinfo.mtime == 1727883000

tests/masonry/builders/test_wheel.py

@@ -487,3 +487,38 @@ def test_generated_script_file(tmp_path: Path) -> None:
 
     with zipfile.ZipFile(str(whl)) as z:
         assert "generated_script_file-0.1.data/scripts/script.sh" in z.namelist()
+
+
+def test_dist_info_date_time_default_value() -> None:
+    module_path = fixtures_dir / "complete"
+    WheelBuilder.make(Factory().create_poetry(module_path))
+
+    whl = module_path / "dist" / "my_package-1.2.3-py3-none-any.whl"
+
+    with zipfile.ZipFile(str(whl)) as z:
+        assert z.getinfo("my_package-1.2.3.dist-info/WHEEL").date_time == (
+            2016,
+            1,
+            1,
+            0,
+            0,
+            0,
+        )
+
+
+def test_dist_info_date_time_value_from_envvar(monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.setenv("SOURCE_DATE_EPOCH", "1727883000")
+    module_path = fixtures_dir / "complete"
+    WheelBuilder.make(Factory().create_poetry(module_path))
+
+    whl = module_path / "dist" / "my_package-1.2.3-py3-none-any.whl"
+
+    with zipfile.ZipFile(str(whl)) as z:
+        assert z.getinfo("my_package-1.2.3.dist-info/WHEEL").date_time == (
+            2024,
+            10,
+            2,
+            15,
+            30,
+            0,
+        )