From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 7189006716065808384 X-Received: by 2002:a05:6870:b020:b0:14f:9d87:3d58 with SMTP id y32-20020a056870b02000b0014f9d873d58mr7952993oae.108.1673821060535; Sun, 15 Jan 2023 14:17:40 -0800 (PST) X-BeenThere: isar-users@googlegroups.com Received: by 2002:a05:6830:621b:b0:661:b84b:eb5e with SMTP id cd27-20020a056830621b00b00661b84beb5els2159045otb.3.-pod-prod-gmail; Sun, 15 Jan 2023 14:17:40 -0800 (PST) X-Google-Smtp-Source: AMrXdXv+mXdUz+Ct1flWGaQ17m8l4BMHfjuSfMTwR247aOrwWKF0v2e8qwuqYItCgA7CutWwwbl6 X-Received: by 2002:a05:6830:1107:b0:684:c286:11f0 with SMTP id w7-20020a056830110700b00684c28611f0mr7971197otq.7.1673821060071; Sun, 15 Jan 2023 14:17:40 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1673821060; cv=none; d=google.com; s=arc-20160816; b=e9AcuyOnSjsxmCRcyEtqXRgA43EJ2F9RnK4DeHnf1gtqtEOmcpvDKBNRNabZo3vQ// +W+OZbhNBBAkAspeq+j8+zGvFFLkV4s+hBKzHf0VbyZL1EBWeDLEVCHiLaN/dWW/wcK4 2WbJYsCj4L3SiUkMxYIYPCw9dHY2d3Y6bMA21QX/wQ3Ea31LVGIR1h8NUTvodwS0fUVG VD7QfJg5YPueum2zCEAgRLJFtlLh28qQ6MfKTcN6Knbdb91MpXjDzCr9WBNrZ2kNdzZG dAoi+zwpNuB+MKCb3fKGbLksvwaULQ1/gdR3jBOfAwO7+kOB3Bo2+vLXXlxOfkepIOoy rOZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from; bh=F+h3td5glBULsVmz6382NtZhDdO9d/2r+BdAZgyRHmY=; b=i6PwaP55/VKSBWoK+q52Namhs9zJtI62BMUMhHZ1jQNz0kn3QzkSs9yutynH9Y8hvp aZYmzTfxllwKnezHJeOUWd2divqhsbzVTqO9TIMAgyXv1URhezaz08n4tw50Miq20Isb z6RWNzLOyOpVwwJhvohEi2YwGiKg0GjWRIx6esh5fQpvcHB/MjePkXZ5Vs+pCFVP7Ggb qq4E/OKbYxr93Enjj+zDJls04o+sRL1em5mIQuXZkAekFXo2TzmqWoxSVVdHwOTNGZHI UteRuqLbD6XDbwHfrB5+1KwI7kbqXJn6souVJsaDceu5L9maBWqAex7SARhBm80ruA7d OFSg== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of roberto.foglietta@linuxteam.org designates 2001:4b7a:2000:18::163 as permitted sender) smtp.mailfrom=roberto.foglietta@linuxteam.org Return-Path: Received: from relay02.th.seeweb.it (relay02.th.seeweb.it. [2001:4b7a:2000:18::163]) by gmr-mx.google.com with ESMTPS id e21-20020a9d0195000000b00684db315574si524113ote.1.2023.01.15.14.17.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 15 Jan 2023 14:17:39 -0800 (PST) Received-SPF: pass (google.com: domain of roberto.foglietta@linuxteam.org designates 2001:4b7a:2000:18::163 as permitted sender) client-ip=2001:4b7a:2000:18::163; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of roberto.foglietta@linuxteam.org designates 2001:4b7a:2000:18::163 as permitted sender) smtp.mailfrom=roberto.foglietta@linuxteam.org Received: from localhost.localdomain (unknown [IPv6:2a02:8071:3187:7b80:8d79:8896:56be:2c19]) by m-r1.th.seeweb.it (Postfix) with ESMTPA id 480DE1F58D; Sun, 15 Jan 2023 23:17:38 +0100 (CET) From: roberto.foglietta@linuxteam.org To: isar-users@googlegroups.com Cc: roberto.foglietta@gmail.com Subject: [PATCH v7] suggested changes for reproducibility patchset v7 Date: Sun, 15 Jan 2023 23:17:34 +0100 Message-Id: <20230115221734.741365-1-roberto.foglietta@linuxteam.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TUID: Wme2uTnnthS8 From: "Roberto A. Foglietta" suggested changes for reproducibility patchset WARNING: eval-image-1.0-r0 do_rootfs_finalize: modified timestamp (1673628837) of 3 files for image reproducibly List of files modified could be found here: ./build/tmp/deploy/images/debx86/files.modified_timestamps v.2: rebased on current ilbers:next v.3: new script added: wic-extract-rootfs-partition.sh [image.wic] v.4: example with for epoch generation from git v.5: reverted the example and rework some few code v.6: the 1st part of the warning shows up each time the epoch is used while the 2nd line appears only when some files has been touched This allows the user to know the current situation aboat epoch. v.7: forgot to commit before producing the patch v6 but sent! Signed-off-by: Roberto A. Foglietta produc Signed-off-by: Roberto A. Foglietta --- meta-isar/conf/local.conf.sample | 2 +- meta/classes/image-account-extension.bbclass | 6 +-- meta/classes/image.bbclass | 22 +++++---- meta/classes/initramfs.bbclass | 4 +- wic-extract-rootfs-partition.sh | 52 ++++++++++++++++++++ 5 files changed, 71 insertions(+), 15 deletions(-) create mode 100755 wic-extract-rootfs-partition.sh diff --git a/meta-isar/conf/local.conf.sample b/meta-isar/conf/local.conf.sample index 6208623e..1d7e178a 100644 --- a/meta-isar/conf/local.conf.sample +++ b/meta-isar/conf/local.conf.sample @@ -257,4 +257,4 @@ USER_isar[flags] += "clear-text-password" # Non git repository users can use value from 'stat -c%Y ChangeLog' # To know more details about this variable and how to set the value refer below # https://reproducible-builds.org/docs/source-date-epoch/ -#SOURCE_DATE_EPOCH = +#SOURCE_DATE_EPOCH = "" diff --git a/meta/classes/image-account-extension.bbclass b/meta/classes/image-account-extension.bbclass index bb173b14..1d49054c 100644 --- a/meta/classes/image-account-extension.bbclass +++ b/meta/classes/image-account-extension.bbclass @@ -256,11 +256,11 @@ image_postprocess_accounts() { # chpasswd adds a random salt when running against a clear-text password. # For reproducible images, we manually generate the password and use the # SOURCE_DATE_EPOCH to generate the salt in a deterministic way. - if [ -z "${SOURCE_DATE_EPOCH}"]; then + if [ -z "${SOURCE_DATE_EPOCH}" ]; then chpasswd_args="" else - salt="$(echo "${SOURCE_DATE_EPOCH}" | sha256sum -z | cut -c 1-15)" - password="$(openssl passwd -6 -salt $salt "$password")" + salt="$(echo ${SOURCE_DATE_EPOCH} | sha256sum -z | cut -c 1-15)" + password="$(openssl passwd -6 -salt $salt $password)" fi fi printf '%s:%s' "$name" "$password" | sudo chroot '${ROOTFSDIR}' \ diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass index 063b9a3b..191c3940 100644 --- a/meta/classes/image.bbclass +++ b/meta/classes/image.bbclass @@ -310,8 +310,8 @@ python() { # invalidate the SSTATE entries for most packages, even if they don't use the # global SOURCE_DATE_EPOCH variable. rootfs_install_pkgs_install_prepend() { - if [ ! -z "${SOURCE_DATE_EPOCH}" ]; then - export SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH}" + if [ -n "${SOURCE_DATE_EPOCH}" ]; then + export SOURCE_DATE_EPOCH fi } @@ -443,13 +443,17 @@ EOSUDO # Set same time-stamps to the newly generated file/folders in the # rootfs image for the purpose of reproducible builds. - test ! -z "${SOURCE_DATE_EPOCH}" && \ - sudo find ${ROOTFSDIR} -newermt \ - "$(date -d@${SOURCE_DATE_EPOCH} '+%Y-%m-%d %H:%M:%S')" \ - -printf "%y %p\n" \ - -exec touch '{}' -h -d@${SOURCE_DATE_EPOCH} ';' > ${DEPLOY_DIR_IMAGE}/files.modified_timestamps && \ - bbwarn "$(grep ^f ${DEPLOY_DIR_IMAGE}/files.modified_timestamps) \nModified above file timestamps to build image reproducibly" - + if [ -n "${SOURCE_DATE_EPOCH}" ]; then + fn="${DEPLOY_DIR_IMAGE}/files.modified_timestamps" + sudo find ${ROOTFSDIR} -newermt "$(date -d@"${SOURCE_DATE_EPOCH}" '+%Y-%m-%d %H:%M:%S')" \ + -printf "%y %p\n" -exec touch '{}' -h -d@${SOURCE_DATE_EPOCH} ';' >"$fn" + msg="" + ncfs=$(egrep ^f "$fn" | wc -l) + if [ $ncfs -gt 0 ]; then + msg="\n List of files modified could be found here: ."${DEPLOY_DIR_IMAGE}"/files.modified_timestamps" + fi + bbwarn "Modified timestamp ("${SOURCE_DATE_EPOCH}") of "$ncfs" files for image reproducibly.$msg" + fi } addtask rootfs_finalize before do_rootfs after do_rootfs_postprocess diff --git a/meta/classes/initramfs.bbclass b/meta/classes/initramfs.bbclass index db283347..1b98bc06 100644 --- a/meta/classes/initramfs.bbclass +++ b/meta/classes/initramfs.bbclass @@ -33,8 +33,8 @@ do_generate_initramfs() { rootfs_do_qemu # generate reproducible initrd if requested - if [ ! -z "${SOURCE_DATE_EPOCH}" ]; then - export SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH}" + if [ -n "${SOURCE_DATE_EPOCH}" ]; then + export SOURCE_DATE_EPOCH fi sudo -E chroot "${INITRAMFS_ROOTFS}" \ diff --git a/wic-extract-rootfs-partition.sh b/wic-extract-rootfs-partition.sh new file mode 100755 index 00000000..48de0d3a --- /dev/null +++ b/wic-extract-rootfs-partition.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# +# Copyright (c) Roberto A. Foglietta, 2023 +# +# Authors: +# Roberto A. Foglietta +# +# SPDX-License-Identifier: MIT +# +#set -ex + +if [ "$(whoami)" != "root" ]; then + echo + echo "WARNING: this script should run as root, sudo!" + sudo -E $0 "$@" + exit $? +fi + +if [ -e "$1" ]; then + fimg=$(readlink -e $1) +fi + +cd $(dirname $0) + +if [ ! -n "$1" -a ! -e "$fimg" ]; then + fimg=$(ls -1 build/tmp/deploy/images/*/*.wic) + n=( $fimg ) + if [ ${#n[@]} -gt 1 ]; then + echo + echo "WARNING: more than one image found, choose one:" + echo + echo "$fimg" + echo + exit 1 + fi +fi + +if [ ! -e "$fimg" ]; then + echo + echo "ERROR: no any image or block device ${1:+'$1' }found, abort!" + echo + exit 1 +fi + +wicf=$fimg +losetup -Pf $wicf +ldev=$(losetup -j $wicf | cut -d: -f1 | tail -n1) +echo loopdev:$ldev +dd if=${ldev}p2 bs=1M of=${wicf/.wic/.rootfs} status=progress +chown $(id -u).$(id -g) ${wicf/.wic/.rootfs} +du -ms ${wicf/.wic/.rootfs} +losetup -d $ldev -- 2.34.1