crates/vm/build.rs (1)

73-81: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use SOURCE_DATE_EPOCH and UTC timezone for reproducible build metadata.

The git_timestamp() function uses SystemTime::now() as a fallback, and get_git_timestamp_datetime() converts that Unix epoch to DateTime<Local> (line 129), then formats it with patterns like "%b %e %Y" (line 136) and "%H:%M:%S" (line 141). This embeds local timezone information and current system time into RUSTPYTHON_BUILD_INFO, producing different formatted timestamps across equivalent builds in different timezones or at different times. The code already references reproducible-builds.org on line 98 but does not honor the spec. The reproducible-builds standard requires checking SOURCE_DATE_EPOCH and using stable (UTC) timezone rendering to ensure identical sources produce identical binaries.

Suggested fix

-use chrono::{Local, prelude::DateTime};
+use chrono::{Utc, prelude::DateTime};
 use core::time::Duration;
@@
 fn git_timestamp() -> String {
-    git(&["log", "-1", "--format=%ct"]).unwrap_or_else(|_| {
-        SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .unwrap_or_default()
-            .as_secs()
-            .to_string()
-    })
+    env::var("SOURCE_DATE_EPOCH")
+        .ok()
+        .or_else(|| git(&["log", "-1", "--format=%ct"]).ok())
+        .unwrap_or_else(|| {
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap_or_default()
+                .as_secs()
+                .to_string()
+        })
 }
@@
-fn get_git_timestamp_datetime() -> DateTime<Local> {
+fn get_git_timestamp_datetime() -> DateTime<Utc> {
     let timestamp = git_timestamp().parse::<u64>().unwrap_or_default();
     let datetime = UNIX_EPOCH + Duration::from_secs(timestamp);
-    datetime.into()
+    DateTime::<Utc>::from(datetime)
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/vm/build.rs` around lines 73 - 81, The
git_timestamp()/get_git_timestamp_datetime() logic must honor SOURCE_DATE_EPOCH
and always render timestamps in UTC for reproducible builds: change
git_timestamp() to first look for the SOURCE_DATE_EPOCH env var and use that
value (as a Unix epoch string) if present; only fall back to the git log output
or SystemTime::now() when SOURCE_DATE_EPOCH is absent; update
get_git_timestamp_datetime() to parse the epoch into a UTC DateTime (use
chrono::Utc or equivalent) instead of DateTime<Local> and format with UTC-based
patterns so RUSTPYTHON_BUILD_INFO is produced deterministically across timezones
and builds.