// 源码中的 __DATE__ 宏
printf("Built on %s at %s\n", __DATE__, __TIME__);
// 每次编译输出不同 → 不可重现

# 验证构建沙箱中的时间
guix build vim --no-substitutes 2>&1 | grep "epoch"

# 构建日志中可以看到：
# date: Thu Jan  1 00:00:00 UTC 1970

;; 在包定义中添加补丁来移除时间戳
(package
  ;; ...
  (source (origin
            ;; ...
            (patches (search-patches "myapp-remove-timestamp.patch"))))
  (arguments
    (list
      #:phases
      #~(modify-phases %standard-phases
          ;; 方法一：设置 SOURCE_DATE_EPOCH 环境变量
          (add-before 'configure 'set-source-date-epoch
            (lambda _
              (setenv "SOURCE_DATE_EPOCH" "0")))

          ;; 方法二：替换硬编码的时间戳
          (add-after 'unpack 'remove-build-timestamp
            (lambda _
              (substitute* "src/version.c"
                (("__DATE__")
                 "\"1970-01-01\"")
                (("__TIME__")
                 "\"00:00:00\""))
              #t))))))

# 手动设置
export SOURCE_DATE_EPOCH=0

# 在构建系统中
make SOURCE_DATE_EPOCH=0

# Guix 沙箱中自动设置为 0

(arguments
  (list
    #:make-flags
    #~(list
        ;; 设置编译器
        (string-append "CC=" #$(cc-for-target))
        ;; 设置安装前缀
        (string-append "PREFIX=" #$output)
        ;; 自定义变量
        "VERBOSE=1")
    #:phases
    #~(modify-phases %standard-phases
        (add-before 'build 'set-env
          (lambda _
            ;; 设置环境变量
            (setenv "CFLAGS" "-O2 -g")
            (setenv "LDFLAGS" "-Wl,-z,relro")
            ;; 禁止记录构建路径
            (setenv "LC_ALL" "C.UTF-8")
            #t)))))

(arguments
  (list
    #:phases
    #~(modify-phases %standard-phases
        ;; strip 阶段移除调试信息中的构建路径
        ;; (这通常由标准阶段自动处理)

        ;; 处理 Go 二进制中的构建路径
        (add-before 'build 'trim-build-path
          (lambda _
            (setenv "GOPATH" "/tmp/gopath")
            (setenv "GOCACHE" "/tmp/gocache")
            #t)))))

# 当前：输入寻址
/gnu/store/<hash-of-inputs>-vim-9.0

# 未来：内容寻址
/gnu/store/<hash-of-content>-vim-9.0

;; 使用精确的 commit hash，而非 tag
(origin
  (method git-fetch)
  (uri (git-reference
        (url "https://github.com/user/project")
        (commit "abc1234def56789012345678901234567890abcd")))
  (sha256 (base32 "0xyz...")))

(source (origin
          (method url-fetch)
          (uri (string-append "https://example.com/foo-"
                              version ".tar.gz"))
          (sha256 (base32 "0abc..."))
          ;; 补丁列表
          (patches (search-patches
                     "foo-fix-build.patch"
                     "foo-security-cve-2024-1234.patch"
                     "foo-reproducible-build.patch"))))

# 创建补丁目录
mkdir -p /path/to/guix-patches

# 常见的可重现构建补丁类型：

# 1. 移除 __DATE__ 和 __TIME__
cat > foo-fix-date.patch << 'EOF'
--- a/src/version.c
+++ b/src/version.c
@@ -1,3 +1,3 @@
-char *build_date = __DATE__;
-char *build_time = __TIME__;
+char *build_date = "1970-01-01";
+char *build_time = "00:00:00";
EOF

# 2. 固定 sort 排序
cat > foo-fix-sort.patch << 'EOF'
--- a/Makefile
+++ b/Makefile
@@ -10,1 +10,1 @@
-LIST = $(shell ls src/)
+LIST = $(shell ls src/ | LC_ALL=C sort)
EOF

# 3. 移除用户名和主机名
cat > foo-fix-user.patch << 'EOF'
--- a/configure.ac
+++ b/configure.ac
@@ -5,2 +5,2 @@
-AC_DEFINE_UNQUOTED([BUILD_USER], ["$USER"])
-AC_DEFINE_UNQUOTED([BUILD_HOST], ["$HOSTNAME"])
+AC_DEFINE_UNQUOTED([BUILD_USER], ["guix"])
+AC_DEFINE_UNQUOTED([BUILD_HOST], ["guix"])
EOF

# Guix 补丁通常存储在 gnu/packages/patches/ 目录
ls ~/.config/guix/current/share/guix/patches/

# 使用 search-patches 函数搜索
# (search-patches "foo-fix.patch") 会在标准路径中搜索

# 方法一：两次构建对比
guix build vim --no-substitutes -o /tmp/build1
guix build vim --no-substitutes -o /tmp/build2
diffoscope /tmp/build1 /tmp/build2

# 方法二：使用 diffoscope 工具
guix shell diffoscope -- diffoscope /gnu/store/abc... /gnu/store/def...

;; 在 manifest 中添加诊断工具
(specifications->manifest
  '("diffoscope"      ; 二进制比较工具
    "strip-nondeterminism"  ; 移除非确定性信息
    "diffutils"       ; diff 工具
    "binutils"))      ; objdump 等

# 从源码重新构建并与官方二进制对比
guix build --no-substitutes --check vim

# --check 选项会：
# 1. 从源码构建
# 2. 与已有的 store 对象对比
# 3. 如果不一致则报错

# 验证多个包
for pkg in vim git python gcc; do
  echo "Checking $pkg..."
  guix build --no-substitutes --check $pkg || \
    echo "FAILED: $pkg"
done

;; project-env.scm — 完全确定性的开发环境
(specifications->manifest
  '("gcc-toolchain"     ; 编译器工具链
    "cmake"             ; 构建系统
    "pkg-config"        ; 库发现
    "gdb"               ; 调试器
    "valgrind"          ; 内存检查
    "strace"            ; 系统调用跟踪
    "python"            ; 脚本
    "python-pytest"))   ; 测试框架

# 从 manifest 创建可重现环境
guix time-machine --channels=channels.scm -- \
  shell --manifest=project-env.scm

# 步骤 1：团队负责人锁定环境
guix describe --format=channels > channels.scm
# channels.scm 和 manifest.scm 提交到 Git 仓库

# 步骤 2：团队成员使用
git pull
guix time-machine --channels=channels.scm -- \
  shell --manifest=manifest.scm

# 现在所有成员拥有完全相同的开发环境

# .gitlab-ci.yml
stages:
  - build
  - test

build:
  stage: build
  image: guix
  script:
    - guix time-machine --channels=channels.scm -- \
        build --no-substitutes my-project

test:
  stage: test
  image: guix
  script:
    - guix time-machine --channels=channels.scm -- \
        shell --manifest=manifest.scm -- make test

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Guix
        run: |
          wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
          chmod +x guix-install.sh
          sudo ./guix-install.sh
      - name: Build
        run: |
          guix time-machine --channels=channels.scm -- \
            build --no-substitutes my-project