[PATCH 7/8] make our internal chroots bit-by-bit reproducible

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

By that, the generated sstate artifacts are also bit identical which
reduces the cache size. It further makes it possible to re-use the
artifacts with the hashequiv logic of bitbake.

For that, we auto-select all rootfs features needed for reproducible
contents.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta-test/recipes-core/images/isar-rootfs-ci.bb | 2 +-
 meta/classes-recipe/image.bbclass               | 4 ----
 meta/classes-recipe/initramfs.bbclass           | 3 +--
 meta/classes-recipe/rootfs.bbclass              | 9 +++++++++
 meta/classes-recipe/sdk.bbclass                 | 2 +-
 5 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/meta-test/recipes-core/images/isar-rootfs-ci.bb b/meta-test/recipes-core/images/isar-rootfs-ci.bb
index 5ac33665..4aeed71f 100644
--- a/meta-test/recipes-core/images/isar-rootfs-ci.bb
+++ b/meta-test/recipes-core/images/isar-rootfs-ci.bb
@@ -7,7 +7,7 @@
 ROOTFS_MANIFEST_DEPLOY_DIR = "${DEPLOY_DIR_IMAGE}"
 
 ROOTFSDIR = "${WORKDIR}/rootfs"
-ROOTFS_FEATURES = "generate-sbom"
+ROOTFS_FEATURES += "generate-sbom"
 
 inherit multiarch
 inherit rootfs
diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index 7abda3de..a609cde5 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -94,13 +94,9 @@ inherit essential
 
 ROOTFSDIR = "${IMAGE_ROOTFS}"
 ROOTFS_FEATURES += "\
-    clean-package-cache \
     clean-apt-lists \
-    clean-pycache \
     generate-manifest \
     export-dpkg-status \
-    clean-log-files \
-    clean-debconf-cache \
     populate-systemd-preset \
     generate-sbom \
     clean-apt-credentials \
diff --git a/meta/classes-recipe/initramfs.bbclass b/meta/classes-recipe/initramfs.bbclass
index a647b6ea..45626319 100644
--- a/meta/classes-recipe/initramfs.bbclass
+++ b/meta/classes-recipe/initramfs.bbclass
@@ -26,8 +26,7 @@ SBOM_DISTRO_NAME:append = "-Initramfs"
 DEPENDS += "${INITRAMFS_INSTALL}"
 
 ROOTFSDIR = "${INITRAMFS_ROOTFS}"
-ROOTFS_FEATURES = "generate-manifest generate-sbom"
-ROOTFS_FEATURES += "generate-initrd"
+ROOTFS_FEATURES += "generate-manifest generate-sbom generate-initrd"
 ROOTFS_PACKAGES = "${INITRAMFS_GENERATOR_PKG} ${INITRAMFS_PREINSTALL} ${INITRAMFS_INSTALL}"
 
 # validate whether there are incompatible packages in the installation list
diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 9a08312e..e5d158ca 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -41,6 +41,15 @@ ROOTFS_BASE_DISTRO ?= "${BASE_DISTRO}"
 # 'populate-systemd-preset' - enable systemd units according to systemd presets
 # 'clean-apt-credentials' - remove apt auth credentials written by ISAR_APT_CREDS
 
+# convenience variable to enable all features needed for a reproducible rootfs build
+ROOTFS_FEATURES_REPRODUCIBLE = " \
+    clean-package-cache \
+    clean-log-files \
+    clean-debconf-cache \
+    clean-pycache \
+"
+ROOTFS_FEATURES += "${ROOTFS_FEATURES_REPRODUCIBLE}"
+
 # only supported from bookworm / jammy on
 ROOTFS_FEATURES:remove:buster = "generate-sbom"
 ROOTFS_FEATURES:remove:bullseye = "generate-sbom"
diff --git a/meta/classes-recipe/sdk.bbclass b/meta/classes-recipe/sdk.bbclass
index d79de2bf..ca38cfc3 100644
--- a/meta/classes-recipe/sdk.bbclass
+++ b/meta/classes-recipe/sdk.bbclass
@@ -49,7 +49,7 @@ ROOTFS_ARCH:class-sdk = "${HOST_ARCH}"
 ROOTFS_DISTRO:class-sdk = "${@get_rootfs_distro(d)}"
 ROOTFS_PACKAGES:class-sdk = "sdk-files ${SDK_TOOLCHAIN} ${SDK_PREINSTALL} ${@isar_multiarch_packages('SDK_INSTALL', d)}"
 ROOTFS_VARDEPS:class-sdk = "SDK_INSTALL SDK_INCLUDE_ISAR_APT"
-ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom clean-apt-credentials"
+ROOTFS_FEATURES:append:class-sdk = " clean-apt-lists clean-apt-credentials generate-manifest export-dpkg-status generate-sbom"
 ROOTFS_MANIFEST_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"
 ROOTFS_DPKGSTATUS_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"
 
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260820083014.3377283-8-felix.moessbauer%40siemens.com.