[PATCH v3] libubootenv: generate reproducible source tarball

[PATCH v3] libubootenv: generate reproducible source tarball

[srinuvasan.a via isar-users]

From: srinuvasan <srinuvasan.a@siemens.com>

Apply additional options to the tar command used to generate
reproducible source tarball: (1) use numeric and null [GU]IDs,
-clamp-mtime for file modification times to never be later than
SOURCE_DATE_EPOCH (preserving mtimes for files not modified by
the recipe) and --sort=name for consistent ordering within the
archive.

Signed-off-by: Cedric Hombourger <cedric.hombourger@siemens.com>
Signed-off-by: srinuvasan <srinuvasan.a@siemens.com>
---
 meta/classes-recipe/dpkg-source.bbclass               | 5 +++++
 meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/dpkg-source.bbclass b/meta/classes-recipe/dpkg-source.bbclass
index a16e5812..1227da36 100644
--- a/meta/classes-recipe/dpkg-source.bbclass
+++ b/meta/classes-recipe/dpkg-source.bbclass
@@ -5,6 +5,11 @@
 
 inherit dpkg-base
 
+TAR_REPRO_OPTS ?= "--exclude=.git --exclude=debian \
+--mtime=@${SOURCE_DATE_EPOCH} --clamp-mtime \
+--owner=0 --group=0 --numeric-owner \
+--sort=name"
+
 DPKG_SOURCE_EXTRA_ARGS ?= "-I"
 
 DEBIAN_SOURCE ?= "${BPN}"
diff --git a/meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb b/meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb
index 4d64ff8e..d2908536 100644
--- a/meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb
+++ b/meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb
@@ -25,5 +25,5 @@ CHANGELOG_V ?= "${PV}+isar-${SRCREV}"
 do_prepare_build() {
     deb_add_changelog
     cd ${WORKDIR}
-    tar cJf ${BPN}_${PV}+isar.orig.tar.xz --exclude=.git --exclude=debian ${P}
+    tar cJf ${BPN}_${PV}+isar.orig.tar.xz ${TAR_REPRO_OPTS} ${P}
 }
-- 
2.34.1

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260113054631.85562-1-srinuvasan.a%40siemens.com.

Re: [PATCH v3] libubootenv: generate reproducible source tarball

[Zhihang Wei]

Applied to next, thanks.

Zhihang

On 1/13/26 06:46, srinuvasan.a via isar-users wrote:
> From: srinuvasan <srinuvasan.a@siemens.com>
>
> Apply additional options to the tar command used to generate
> reproducible source tarball: (1) use numeric and null [GU]IDs,
> -clamp-mtime for file modification times to never be later than
> SOURCE_DATE_EPOCH (preserving mtimes for files not modified by
> the recipe) and --sort=name for consistent ordering within the
> archive.
>
> Signed-off-by: Cedric Hombourger <cedric.hombourger@siemens.com>
> Signed-off-by: srinuvasan <srinuvasan.a@siemens.com>
> ---
>   meta/classes-recipe/dpkg-source.bbclass               | 5 +++++
>   meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb | 2 +-
>   2 files changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/dpkg-source.bbclass b/meta/classes-recipe/dpkg-source.bbclass
> index a16e5812..1227da36 100644
> --- a/meta/classes-recipe/dpkg-source.bbclass
> +++ b/meta/classes-recipe/dpkg-source.bbclass
> @@ -5,6 +5,11 @@
>   
>   inherit dpkg-base
>   
> +TAR_REPRO_OPTS ?= "--exclude=.git --exclude=debian \
> +--mtime=@${SOURCE_DATE_EPOCH} --clamp-mtime \
> +--owner=0 --group=0 --numeric-owner \
> +--sort=name"
> +
>   DPKG_SOURCE_EXTRA_ARGS ?= "-I"
>   
>   DEBIAN_SOURCE ?= "${BPN}"
> diff --git a/meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb b/meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb
> index 4d64ff8e..d2908536 100644
> --- a/meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb
> +++ b/meta/recipes-bsp/libubootenv/libubootenv_0.3.5-0.1.bb
> @@ -25,5 +25,5 @@ CHANGELOG_V ?= "${PV}+isar-${SRCREV}"
>   do_prepare_build() {
>       deb_add_changelog
>       cd ${WORKDIR}
> -    tar cJf ${BPN}_${PV}+isar.orig.tar.xz --exclude=.git --exclude=debian ${P}
> +    tar cJf ${BPN}_${PV}+isar.orig.tar.xz ${TAR_REPRO_OPTS} ${P}
>   }

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/9189206d-20d4-4024-90b0-07b4fc99e12a%40ilbers.de.