git submodules do not specify a version, leading to non-repeatable builds

[gdt]

Describe Your Environment

• building from source

Describe the bug

Builds from a tag should be repeatable. (Ideally, they would be bit-for-bit reproducible.)

To Reproduce

Build, get a fix merged in one of the git submodules, build again, and observe that the build is non-repeatable.

Expected behavior

Even if there are new commits in a submodule repo, the version used for e.g. 1.38.3 is unchanged.

Workaround

In pkgsrc, we have lines for submodules so that they can be downloaded at make fetch time, because a build using the networ is a bug. Rather than using the branch name, I have found the sha1 of the commit on the branch and used that. Thus pkgsrc is repeatable, but it's not repeatable in the way it should be.

[connortechnology]

I do not claim to actually know what I am doing, but I know that every time I want to move to a new version of a submodule I have to commit it. Each submodule should be targetting a specific commit. In our redhat package builds we target specific commits for submodules.

The git submodule commands should give us the same submdule commits for the same zoneminder commit.

Also, we do build .zips on the release page with the appropriate submodules included.

[gdt]

I will try to understand this better. I am fetching a git tar.gz based on either a tag or a sha1 (if I'm targeting a commit along the branch post release). I guess from that I should be able to tell what the hashes are, or maybe I need a real git checkout. Found it - the hashes are, or show up with diff in, dep/RtspServer. I am in a state with uncommitted submodule changes:

iff --git a/dep/RtspServer b/dep/RtspServer
index a07159957..a8781ec60 160000
--- a/dep/RtspServer
+++ b/dep/RtspServer
@@ -1 +1 @@
-Subproject commit a071599575f60a6f1f424e1f9b408dad7da734a8
+Subproject commit a8781ec608d0252d4752b64fe2b199b35bcc1695

so it looks like git master in zoneminder wants a071599575f60a6f1f424e1f9b408dad7da734a8 of RtspServer.
If I cd dep/RtspServer and reset --hard to that, then top-level git status is clean.

Seems like it would be good to advance, to get the pipe2 fix into zoneminder master.
(BTW, NetBSD has a pipe2.)

If I get myself unconfused I can suggest some README text. I have never become one with submodules.

[connortechnology]

Ah right. I merged the pipe fix but didn't update Nate to use it! Will do.