From 25bf0e9e2c10bd9dee41bf2ed735a5f4761e5734 Mon Sep 17 00:00:00 2001
From: Rangi <sylvie.oukaour+rangi42@gmail.com>
Date: Mon, 30 Mar 2026 21:18:52 -0400
Subject: [PATCH] `SOURCE_DATE_EPOCH` must be in base 10

---
 src/asm/main.cpp                       |  8 +++++---
 test/asm/invalid-source-date-epoch.err |  1 +
 test/asm/test.sh                       | 14 ++++++++++++++
 3 files changed, 20 insertions(+), 3 deletions(-)
 create mode 100644 test/asm/invalid-source-date-epoch.err

diff --git a/src/asm/main.cpp b/src/asm/main.cpp
index e063250b..afd5d9f7 100644
--- a/src/asm/main.cpp
+++ b/src/asm/main.cpp
@@ -501,9 +501,11 @@ int main(int argc, char *argv[]) {
 	// https://reproducible-builds.org/docs/source-date-epoch/
 	time_t now = time(nullptr);
 	if (char const *sourceDateEpoch = getenv("SOURCE_DATE_EPOCH"); sourceDateEpoch) {
-		// Use `strtoul`, not `parseWholeNumber`, because SOURCE_DATE_EPOCH does
-		// not conventionally support our custom base prefixes
-		now = static_cast<time_t>(strtoul(sourceDateEpoch, nullptr, 0));
+		if (std::optional<uint64_t> epoch = parseWholeNumber(sourceDateEpoch, BASE_10); epoch) {
+			now = static_cast<time_t>(*epoch);
+		} else {
+			warnx("Ignoring invalid `SOURCE_DATE_EPOCH` value \"%s\"", sourceDateEpoch);
+		}
 	}
 	sym_Init(now);
 
diff --git a/test/asm/invalid-source-date-epoch.err b/test/asm/invalid-source-date-epoch.err
new file mode 100644
index 00000000..5035518c
--- /dev/null
+++ b/test/asm/invalid-source-date-epoch.err
@@ -0,0 +1 @@
+warning: Ignoring invalid `SOURCE_DATE_EPOCH` value "0x1234"
diff --git a/test/asm/test.sh b/test/asm/test.sh
index e0b289f7..64eed9ec 100755
--- a/test/asm/test.sh
+++ b/test/asm/test.sh
@@ -161,6 +161,20 @@ done
 
 # These tests do their own thing
 
+i="invalid-source-date-epoch"
+RGBASMFLAGS="-Weverything -Bcollapse"
+(( tests++ ))
+echo "${bold}${green}${i}...${rescolors}${resbold}"
+SOURCE_DATE_EPOCH=0x1234 "$RGBASM" $RGBASMFLAGS /dev/null >"$output" 2>"$errput"
+tryDiff /dev/null "$output" out
+our_rc=$?
+tryDiff invalid-source-date-epoch.err "$errput" err
+(( our_rc = our_rc || $? ))
+(( rc = rc || our_rc ))
+if [[ $our_rc -ne 0 ]]; then
+	(( failed++ ))
+fi
+
 evaluateDepTest () {
 	i="$1"
 	RGBASMFLAGS="-Weverything -Bcollapse -M -"