Re: [PATCH 06/11] update debian initramfs in deterministic mode

["Moessbauer, Felix" <felix.moessbauer@siemens.com>]

On Wed, 2023-01-11 at 09:23 +0100, Henning Schild wrote:
> Am Wed, 11 Jan 2023 04:11:35 +0000
> schrieb Felix Moessbauer <felix.moessbauer@siemens.com>:
> 
> > This patch exports the SOURCE_DATE_EPOCH variable in the image
> > install
> > task. By that, update-initramfs is switched into reproducible mode.
> > Before this patch, each trigger of update-initramfs created a new
> > non-deterministic version of the initramfs.
> > 
> > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > ---
> >  meta/classes/image.bbclass | 7 +++++++
> >  1 file changed, 7 insertions(+)
> > 
> > diff --git a/meta/classes/image.bbclass
> > b/meta/classes/image.bbclass
> > index b86a428..c981c7a 100644
> > --- a/meta/classes/image.bbclass
> > +++ b/meta/classes/image.bbclass
> > @@ -304,6 +304,13 @@ python() {
> >  }
> >  
> >  
> > +# make generation of initramfs reproducible
> > +rootfs_install_pkgs_install_prepend() {
> > +    if [ ! -z "${SOURCE_DATE_EPOCH}" ]; then
> > +        export SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH}"
> > +    fi
> > +}
> 
> Why prepend and not put this right into the task? This will be hard
> to
> maintain.

Yes, true. However, the rootfs_install_pkgs_install is shared across
all rootfs, but we really only want to set the SOURCE_DATE_EPOCH
variable for the final target image install. If we would add it
globally, this would break SSTATE caching all over the place, as it
would have influence on the sbuild chroots.

On the other side, we also cannot whitelist the variable as it
internally changes the logic of many tools so that they run in
deterministic mode. And we also have to rebuild parts that depend on
the value of the variable.

Felix

> 
> Henning
> 
> >  # here we call a command that should describe your whole build
> > system, # this could be "git describe" or something similar.
> >  # set ISAR_RELEASE_CMD to customize, or override do_mark_rootfs to
> > do something
>