Avoid file downloads during build and fix reproducibility

Robin Candaurequested to merge
repro into main

GNU does not include PO files (used for translations) in their git repositories. When building GNU software from git sources, PO files are downloaded during their bootstrap script in prepare() from https://translationproject.org/latest/ in an un-versioned way (see /latest/ in the URL):

[...]
./bootstrap: getting translations into po/.reference for coreutils...
Last-modified header missing -- time-stamps turned off.
2025-11-08 11:02:28 URL:https://translationproject.org/latest/coreutils/ [9257] -> "po/.reference/index.html.tmp" [1]
https://translationproject.org/robots.txt:
2025-11-08 11:02:28 ERROR 404: Not Found.
Last-modified header missing -- time-stamps turned off.
2025-11-08 11:02:28 URL:https://translationproject.org/latest/coreutils/?C=N;O=D [9257] -> "po/.reference/index.html?C=N;O=D.tmp" [1]
Last-modified header missing -- time-stamps turned off.
2025-11-08 11:02:28 URL:https://translationproject.org/latest/coreutils/?C=M;O=A [9257] -> "po/.reference/index.html?C=M;O=A.tmp" [1]
Last-modified header missing -- time-stamps turned off.
2025-11-08 11:02:28 URL:https://translationproject.org/latest/coreutils/?C=S;O=A [9257] -> "po/.reference/index.html?C=S;O=A.tmp" [1]
Last-modified header missing -- time-stamps turned off.
2025-11-08 11:02:28 URL:https://translationproject.org/latest/coreutils/?C=D;O=A [9257] -> "po/.reference/index.html?C=D;O=A.tmp" [1]
Last-modified header missing -- time-stamps turned off.
2025-11-08 11:02:29 URL:https://translationproject.org/latest/ [29646] -> "po/.reference/index.html.tmp" [1]
2025-11-08 11:02:29 URL:https://translationproject.org/latest/coreutils/af.po [192487/192487] -> "po/.reference/af.po" [1]
2025-11-08 11:02:29 URL:https://translationproject.org/latest/coreutils/be.po [255628/255628] -> "po/.reference/be.po" [1]
2025-11-08 11:02:29 URL:https://translationproject.org/latest/coreutils/bg.po [587867/587867] -> "po/.reference/bg.po" [1]
20
[...]

Aside from resulting in a file download during build (which should ideally be generally avoided), this also may break reproducibility. Indeed, since the PO files are downloaded in an unstable way, we can't guarantee the content / state of PO files at any given time across builds (see the current coreutils diffoscope output).

Switching back to the custom dist tarballs (which contains the static translation files) as the primary source for the package is not desirable as per our guidelines established in our RFC 46.

This commit aims to address those concerns by:

  • setting SKIP_PO=1 as an environment variable for the GNU bootstrap script: This skips the PO files downloading step from the bootstrap script; preventing downloading PO files from the internet during build and avoiding unpredictable state / content for said files for reproducible builds.
  • sourcing the signed custom dist tarball for $pkgver and generating / installing PO files from there: This prevents having a package without translation files altogether and it also ensures that the state of the translation files are predictable / matches the version of coreutils we are re-distributing.

All and all, we are still compiling the software from git / "transparent" sources (as defined in our RFC 46) and we are only installing translation files from an "intransparent" dist tarball (not an ideal solution altogether, but still an improvement in terms of packaging and reproducible builds).

Merge request reports