laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix tarball reproducibility: default SOURCE_DATE_EPOCH and sort entries

Browse Source 
build-tarball.sh only applied --mtime when SOURCE_DATE_EPOCH was
explicitly set, and did not sort tar entries. This produced different
tarballs across builds due to varying timestamps and filesystem
ordering. Default SOURCE_DATE_EPOCH to the git commit timestamp and
add --sort=name for deterministic output.
This commit is contained in:
Johnathan Corgan
2026-03-22 20:26:00 +00:00
parent 6aff490251
commit 537eaf0db7
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packaging/systemd/build-tarball.sh
+8 -4
View File
@@ -45,12 +45,16 @@ cp "${SCRIPT_DIR}/README.install.md" "${STAGING_DIR}/"
chmod +x "${STAGING_DIR}/install.sh" "${STAGING_DIR}/uninstall.sh" chmod +x "${STAGING_DIR}/install.sh" "${STAGING_DIR}/uninstall.sh"
# Create tarball (reproducible: normalize timestamps and ownership) # Create tarball (reproducible: normalize timestamps, ownership, and sort order)
cd "${DEPLOY_DIR}" cd "${DEPLOY_DIR}"
TAR_REPRO_FLAGS=""
if [ -n "${SOURCE_DATE_EPOCH:-}" ]; then # Default SOURCE_DATE_EPOCH to git commit timestamp if not set
TAR_REPRO_FLAGS="--mtime=@${SOURCE_DATE_EPOCH}" if [ -z "${SOURCE_DATE_EPOCH:-}" ]; then
SOURCE_DATE_EPOCH=$(git -C "${PROJECT_ROOT}" log -1 --format=%ct)
export SOURCE_DATE_EPOCH
fi fi
TAR_REPRO_FLAGS="--mtime=@${SOURCE_DATE_EPOCH} --sort=name"
if tar --version 2>/dev/null | grep -q 'GNU tar'; then if tar --version 2>/dev/null | grep -q 'GNU tar'; then
TAR_REPRO_FLAGS="${TAR_REPRO_FLAGS} --numeric-owner --owner=0 --group=0" TAR_REPRO_FLAGS="${TAR_REPRO_FLAGS} --numeric-owner --owner=0 --group=0"
fi fi