GH-47798: [CI][Packaging] Enable reproducible builds on host for Linux packages

.github/workflows/package_linux.yml

@@ -89,28 +89,28 @@ jobs:
       fail-fast: false
       matrix:
         id:
-          - almalinux-8-amd64
-          - almalinux-8-arm64
-          - almalinux-9-amd64
-          - almalinux-9-arm64
-          - almalinux-10-amd64
-          - almalinux-10-arm64
-          - amazon-linux-2023-amd64
-          - amazon-linux-2023-arm64
-          - centos-9-stream-amd64
-          - centos-9-stream-arm64
-          - debian-bookworm-amd64
-          - debian-bookworm-arm64
+          # - almalinux-8-amd64
+          # - almalinux-8-arm64
+          # - almalinux-9-amd64
+          # - almalinux-9-arm64
+          # - almalinux-10-amd64
+          # - almalinux-10-arm64
+          # - amazon-linux-2023-amd64
+          # - amazon-linux-2023-arm64
+          # - centos-9-stream-amd64
+          # - centos-9-stream-arm64
+          # - debian-bookworm-amd64
+          # - debian-bookworm-arm64
           - debian-trixie-amd64
-          - debian-trixie-arm64
-          - debian-forky-amd64
-          - debian-forky-arm64
-          - ubuntu-jammy-amd64
-          - ubuntu-jammy-arm64
-          - ubuntu-noble-amd64
-          - ubuntu-noble-arm64
+          # - debian-trixie-arm64
+          # - debian-forky-amd64
+          # - debian-forky-arm64
+          # - ubuntu-jammy-amd64
+          # - ubuntu-jammy-arm64
+          # - ubuntu-noble-amd64
+          # - ubuntu-noble-arm64
     env:
-      DOCKER_VOLUME_PREFIX: ".docker/"
+      BUILD_DIR: "${{ github.workspace }}/packages.build"
     steps:
       - name: Checkout Arrow
         uses: actions/checkout@v6
@@ -182,17 +182,18 @@ jobs:
             version="${GITHUB_REF_NAME#apache-arrow-}"
             echo "ARROW_VERSION=${version}" >> "${GITHUB_ENV}"
           fi
-      - name: Cache Docker Volumes
+      - name: Cache ccache
         uses: actions/cache@v5
         with:
-          path: .docker
+          path: ${{ env.BUILD_DIR }}/ccache
           key:  package-linux-${{ matrix.id }}-${{ hashFiles('cpp/**', 'c_glib/**') }}
           restore-keys: package-linux-${{ matrix.id }}-
-      - name: Set up Ruby
+      - name: Install dependencies
         run: |
           sudo apt update
           sudo apt install -y \
             rake \
+            reprotest \
             ruby \
             ruby-dev
       - name: Prepare apache-arrow-apt-source for arm64
@@ -235,20 +236,25 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          pushd dev/tasks/linux-packages
-          rake docker:pull || :
-          rake --trace ${TASK_NAMESPACE}:build BUILD_DIR=build
-          popd
+          rake -C dev/tasks/linux-packages docker:pull || :
+          if [ "${TASK_NAMESPACE}" = "apt" ]; then
+            reprotest \
+              --vary=-fileordering \
+              --build-command \
+                "rake -C dev/tasks/linux-packages ${TASK_NAMESPACE}:build" \
+              "${PWD}" \
+              "dev/tasks/linux-packages/*/apt/repositories/${DISTRIBUTION}/pool/${DISTRIBUTION_CODE_NAME}/*/*/*/*.deb"
+          else
+            rake -C dev/tasks/linux-packages ${TASK_NAMESPACE}:build
+          fi
       - name: Docker Push
         continue-on-error: true
         if: >-
           success() &&
           github.event_name == 'push' &&
           github.ref_name == 'main'
         run: |
-          pushd dev/tasks/linux-packages
-          rake docker:push
-          popd
+          rake -C dev/tasks/linux-packages docker:push
       - name: Build artifact tarball
         run: |
           mkdir -p "${DISTRIBUTION}"

cpp/cmake_modules/ThirdpartyToolchain.cmake

@@ -3365,8 +3365,20 @@ function(build_google_cloud_cpp_storage)
   # List of dependencies taken from https://github.com/googleapis/google-cloud-cpp/blob/main/doc/packaging.md
   build_crc32c_once()
 
+  set(PATCH_COMMAND)
+  find_program(PATCH patch)
+  if(PATCH)
+    list(APPEND
+         PATCH_COMMAND
+         ${PATCH}
+         -p1
+         -i
+         ${CMAKE_CURRENT_LIST_DIR}/google-cloud-cpp-reproducible-builds.patch)
+  endif()
+
   fetchcontent_declare(google_cloud_cpp
                        ${FC_DECLARE_COMMON_OPTIONS}
+                       PATCH_COMMAND ${PATCH_COMMAND}
                        URL ${google_cloud_cpp_storage_SOURCE_URL}
                        URL_HASH "SHA256=${ARROW_GOOGLE_CLOUD_CPP_BUILD_SHA256_CHECKSUM}")
 
@@ -3843,6 +3855,15 @@ function(build_awssdk)
   prepare_fetchcontent()
   set(BUILD_DEPS OFF)
   set(BUILD_TOOL OFF)
+  # This is for aws-lc. -ffile-prefix-map is needed for reproducible
+  # builds. If ASM flags doesn't have --file-prefix-map, it may
+  # produce different binaries. Only aws-lc uses assembler. So this is
+  # for aws-lc.
+  if(CMAKE_CXX_FLAGS MATCHES "-ffile-prefix-map=" AND NOT CMAKE_ASM_FLAGS MATCHES
+                                                      "-ffile-prefix-map=")
+    string(REGEX MATCH " -ffile-prefix-map=[^ ]+ " FFILE_PREFIX_MAP "${CMAKE_CXX_FLAGS}")
+    string(APPEND CMAKE_ASM_FLAGS "${FFILE_PREFIX_MAP}")
+  endif()
   set(CMAKE_UNITY_BUILD OFF) # Unity build causes some build errors.
   set(ENABLE_TESTING OFF)
   set(IN_SOURCE_BUILD ON)

cpp/cmake_modules/google-cloud-cpp-reproducible-builds.patch

@@ -0,0 +1,25 @@
+From 252064718ccbeec5e4dee45d017036a84ab0c61c Mon Sep 17 00:00:00 2001
+From: Sutou Kouhei <kou@clear-code.com>
+Date: Sat, 31 Jan 2026 21:18:30 +0900
+Subject: [PATCH] Don't embed compiler flags for reproducible builds
+
+---
+ google/cloud/internal/build_info.cc.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/google/cloud/internal/build_info.cc.in b/google/cloud/internal/build_info.cc.in
+index 3251870130..d120f580de 100644
+--- a/google/cloud/internal/build_info.cc.in
++++ b/google/cloud/internal/build_info.cc.in
+@@ -30,7 +30,7 @@ std::string compiler() {
+ // NOLINTNEXTLINE(readability-identifier-naming)
+ std::string compiler_flags() {
+   static char const kCompilerFlags[] =
+-      R"""(@CMAKE_CXX_FLAGS@ ${CMAKE_CXX_FLAGS_${GOOGLE_CLOUD_CPP_BUILD_TYPE_UPPER}})""";
++      R"""(REDACTED FOR REPRODUCIBLE BUILDS)""";
+   return kCompilerFlags;
+ }
+
+-- 
+2.51.0
+

cpp/src/arrow/CMakeLists.txt

@@ -348,6 +348,9 @@ string(REPLACE "${CMAKE_SOURCE_DIR}" "<CMAKE_SOURCE_DIR>" REDACTED_CXX_FLAGS
                ${CMAKE_CXX_FLAGS})
 string(REPLACE "${CMAKE_BINARY_DIR}" "<CMAKE_BINARY_DIR>" REDACTED_CXX_FLAGS
                ${REDACTED_CXX_FLAGS})
+cmake_path(GET PROJECT_SOURCE_DIR PARENT_PATH ARROW_PROJECT_SOURCE_DIR)
+string(REPLACE "${ARROW_PROJECT_SOURCE_DIR}" "<ARROW_PROJECT_SOURCE_DIR>"
+               REDACTED_CXX_FLAGS ${REDACTED_CXX_FLAGS})
 configure_file("util/config.h.cmake" "util/config.h" ESCAPE_QUOTES)
 configure_file("util/config_internal.h.cmake" "util/config_internal.h" ESCAPE_QUOTES)
 install(FILES "${CMAKE_CURRENT_BINARY_DIR}/util/config.h"

dev/tasks/linux-packages/apache-arrow-apt-source/Rakefile

@@ -36,8 +36,16 @@ class ApacheArrowAptSourcePackageTask < PackageTask
     file @archive_name do
       rm_rf(@archive_base_name)
       mkdir(@archive_base_name)
-      download("https://www.apache.org/dyn/closer.lua?action=download&filename=arrow/KEYS",
-               "#{@archive_base_name}/KEYS")
+
+      faketime = ENV["FAKETIME"]
+      begin
+        # Disable faketime to avoid TLS verification error.
+        ENV["FAKETIME"] = nil
+        download("https://www.apache.org/dyn/closer.lua?action=download&filename=arrow/KEYS",
+                 "#{@archive_base_name}/KEYS")
+      ensure
+        ENV["FAKETIME"] = faketime
+      end
       sh("tar", "czf", @archive_name, @archive_base_name)
       rm_rf(@archive_base_name)
     end

dev/tasks/linux-packages/apache-arrow-apt-source/apt/debian-bookworm/Dockerfile

@@ -36,5 +36,6 @@ RUN \
     devscripts \
     fakeroot \
     gnupg \
+    libfaketime \
     lsb-release && \
   apt clean

dev/tasks/linux-packages/apache-arrow-apt-source/apt/debian-forky/Dockerfile

@@ -37,5 +37,6 @@ RUN \
     devscripts \
     fakeroot \
     gnupg \
+    libfaketime \
     lsb-release && \
   apt clean

dev/tasks/linux-packages/apache-arrow-apt-source/apt/debian-trixie/Dockerfile

@@ -37,5 +37,6 @@ RUN \
     devscripts \
     fakeroot \
     gnupg \
+    libfaketime \
     lsb-release && \
   apt clean

dev/tasks/linux-packages/apache-arrow-apt-source/apt/ubuntu-jammy/Dockerfile

@@ -36,6 +36,7 @@ RUN \
     devscripts \
     fakeroot \
     gnupg \
+    libfaketime \
     lsb-release && \
   apt clean && \
   rm -rf /var/lib/apt/lists/*

dev/tasks/linux-packages/apache-arrow-apt-source/apt/ubuntu-noble/Dockerfile

@@ -36,6 +36,7 @@ RUN \
     devscripts \
     fakeroot \
     gnupg \
+    libfaketime \
     lsb-release && \
   apt clean && \
   rm -rf /var/lib/apt/lists/*

dev/tasks/linux-packages/apache-arrow-apt-source/debian/rules

@@ -12,10 +12,12 @@ export DH_OPTIONS
 override_dh_auto_build:
 	gpg \
 	  --no-default-keyring \
+	  --homedir /tmp \
 	  --keyring ./apache-arrow-apt-source.kbx \
 	  --import KEYS
 	gpg \
 	  --no-default-keyring \
+	  --homedir /tmp \
 	  --keyring ./apache-arrow-apt-source.kbx \
 	  --armor \
 	  --export > apache-arrow-apt-source.asc

dev/tasks/linux-packages/apache-arrow/apt/debian-bookworm/Dockerfile

@@ -50,6 +50,7 @@ RUN \
     libbz2-dev \
     libc-ares-dev \
     libcurl4-openssl-dev \
+    libfaketime \
     libgirepository1.0-dev \
     libglib2.0-doc \
     libgmock-dev \

dev/tasks/linux-packages/apache-arrow/apt/debian-forky/Dockerfile

@@ -51,6 +51,7 @@ RUN \
     libbz2-dev \
     libc-ares-dev \
     libcurl4-openssl-dev \
+    libfaketime \
     libgirepository1.0-dev \
     libglib2.0-doc \
     libgmock-dev \

dev/tasks/linux-packages/apache-arrow/apt/debian-trixie/Dockerfile

@@ -39,6 +39,7 @@ RUN \
   apt install -y -V ${quiet} \
     base-files \
     build-essential \
+    ccache \
     clang \
     cmake \
     debhelper \
@@ -51,6 +52,7 @@ RUN \
     libbz2-dev \
     libc-ares-dev \
     libcurl4-openssl-dev \
+    libfaketime \
     libgirepository1.0-dev \
     libglib2.0-doc \
     libgmock-dev \

dev/tasks/linux-packages/apache-arrow/apt/ubuntu-jammy/Dockerfile

@@ -45,6 +45,7 @@ RUN \
     libbz2-dev \
     libc-ares-dev \
     libcurl4-openssl-dev \
+    libfaketime \
     libgirepository1.0-dev \
     libglib2.0-doc \
     libgmock-dev \

dev/tasks/linux-packages/apache-arrow/apt/ubuntu-noble/Dockerfile

@@ -45,6 +45,7 @@ RUN \
     libbz2-dev \
     libc-ares-dev \
     libcurl4-openssl-dev \
+    libfaketime \
     libgirepository1.0-dev \
     libglib2.0-doc \
     libgmock-dev \

dev/tasks/linux-packages/apache-arrow/debian/control.in

@@ -381,6 +381,17 @@ Description: Apache Arrow is a data processing library for analysis
  .
  This package provides GLib based library files for CUDA support.
 
+Package: libarrow-cuda-glib-doc
+Section: doc
+Architecture: any
+Multi-Arch: foreign
+Depends:
+  ${misc:Depends}
+Recommends: libarrow-glib-doc
+Description: Apache Arrow is a data processing library for analysis
+ .
+ This package provides documentations for CUDA support.
+
 Package: gir1.2-arrow-cuda-24.0
 Section: introspection
 Architecture: @CUDA_ARCHITECTURE@

dev/tasks/linux-packages/apache-arrow/debian/libarrow-cuda-glib-doc.doc-base

@@ -0,0 +1,9 @@
+Document: arrow-cuda-glib
+Title: Apache Arrow CUDA GLib Reference Manual
+Author: The Apache Software Foundation
+Abstract: Apache Arrow CUDA GLib provides an API for CUDA integration.
+Section: Programming
+
+Format: HTML
+Index: /usr/share/doc/libarrow-cuda-glib-doc/arrow-cuda-glib/index.html
+Files: /usr/share/doc/libarrow-cuda-glib-doc/arrow-cuda-glib/*.html

dev/tasks/linux-packages/apache-arrow/debian/libarrow-cuda-glib-doc.install

@@ -0,0 +1 @@
+usr/share/doc/arrow-cuda-glib usr/share/doc/libarrow-cuda-glib-doc/

dev/tasks/linux-packages/apache-arrow/debian/libarrow-cuda-glib-doc.links

@@ -0,0 +1,5 @@
+usr/share/doc/libarrow-cuda-glib-doc/arrow-cuda-glib usr/share/devhelp/books/arrow-cuda-glib
+usr/share/doc/libarrow-glib-doc/arrow-glib usr/share/doc/libarrow-cuda-glib-doc/arrow-glib
+usr/share/doc/libglib2.0-doc/gio usr/share/doc/libarrow-cuda-glib-doc/gio
+usr/share/doc/libglib2.0-doc/glib usr/share/doc/libarrow-cuda-glib-doc/glib
+usr/share/doc/libglib2.0-doc/gobject usr/share/doc/libarrow-cuda-glib-doc/gobject

dev/tasks/linux-packages/apache-arrow/debian/rules

@@ -85,13 +85,17 @@ override_dh_auto_build:
 	      --buildsystem=meson+ninja
 
 override_dh_auto_install:
+	dh_auto_install				\
+	  --sourcedirectory=cpp			\
+	  --builddirectory=cpp_build
 	dh_auto_install				\
 	  --sourcedirectory=c_glib		\
 	  --builddirectory=c_glib_build		\
 	  --buildsystem=meson+ninja
-	dh_auto_install				\
-	  --sourcedirectory=cpp			\
-	  --builddirectory=cpp_build
+	sed \
+	  -i \
+	  -e "s,$(CURDIR)/c_glib/../cpp_build/$(BUILD_TYPE),/usr/lib/$$(dpkg-architecture -qDEB_HOST_MULTIARCH),g" \
+	  debian/tmp/usr/lib/$$(dpkg-architecture -qDEB_HOST_MULTIARCH)/pkgconfig/*.pc
 
 override_dh_auto_test:
 	# TODO: We need Boost 1.64 or later to build tests for