A small step towards reproducible packaging...
Currently only tested with upcoming smartmontools package - contains
only exe, man, doc files (no dll, lib, ...). Multiple cygport runs
produce binary identical distribution tarballs if SOURCE_DATE_EPOCH
(from the past) is specified in the cygport file.
--
Regards,
Christian
From 146b1df83a20ccd71e57d6123c7ee24b8390ca3a Mon Sep 17 00:00:00 2001
From: Christian Franke <christian.fra...@t-online.de>
Date: Wed, 23 Aug 2023 19:27:02 +0200
Subject: [PATCH] Add initial support for SOURCE_DATE_EPOCH
If specified, ensure that the header timestamps of executables
and of compressed man pages are set to this value.
Instruct tar to avoid more recent modification times and
sort all entries by name.
---
bin/cygport.in | 14 +++++++++++++-
lib/pkg_pkg.cygpart | 11 +++++++++--
lib/src_postinst.cygpart | 21 +++++++++++++++++++++
3 files changed, 43 insertions(+), 3 deletions(-)
diff --git a/bin/cygport.in b/bin/cygport.in
index 3f89ac67..f7c476b0 100755
--- a/bin/cygport.in
+++ b/bin/cygport.in
@@ -232,7 +232,7 @@ source ${_privlibdir}/check_funcs.cygpart
# check now for all mandatory programs
for _myprog in bzip2 cat chmod cp diff diffstat dos2unix file find gawk grep
gzip \
- install ln mkdir mv patch rm rsync sed sort tar xargs which xz
+ install ln mkdir mv patch rm rsync sed sort tar touch xargs
which xz
do
if ! check_prog ${_myprog}
then
@@ -490,6 +490,18 @@ do
done
unset restrict
+if [ "${SOURCE_DATE_EPOCH+y}" = "y" ]
+then
+ if [ -n "$(echo "${SOURCE_DATE_EPOCH}" | sed -e 's/^$/X/' -e
's/[0-9]//g')" ]
+ then
+ error "Malformed SOURCE_DATE_EPOCH: '${SOURCE_DATE_EPOCH}'"
+ fi
+ case $(peflags --version 2>/dev/null | sed -n '1s/^.* //p') in
+ 4.6.[6-9]|4.[7-9]*|[5-9]*) ;;
+ *) error "SOURCE_DATE_EPOCH requires peflags 4.6.6 or later"
+ esac
+fi
+
################################################################################
#
diff --git a/lib/pkg_pkg.cygpart b/lib/pkg_pkg.cygpart
index 2a2bb663..3869bdb7 100644
--- a/lib/pkg_pkg.cygpart
+++ b/lib/pkg_pkg.cygpart
@@ -42,7 +42,7 @@ TAR_COMPRESSION_EXT="${TAR_COMPRESSION_EXT:-xz}"
#****
__tar() {
- local TAR_COMPRESSION_OPT;
+ local TAR_COMPRESSION_OPT TAR_SOURCE_DATE_OPTS;
# We could use --auto-compress, but this also constrains the extension
# to the currently valid set. We could probe if tar supports the
@@ -65,7 +65,14 @@ __tar() {
error "tar option for
TAR_COMPRESSION_EXT='${TAR_COMPRESSION_EXT}' unknown"
;;
esac
- tar ${TAR_COMPRESSION_OPT} --owner=Guest:501 --group=None:513 -cvf "$@"
+
+ if [ -n "${SOURCE_DATE_EPOCH}" ]
+ then
+ # Ensure reproducible sort order and last modification times <=
SOURCE_DATE_EPOCH
+ TAR_SOURCE_DATE_OPTS="--sort=name --mtime=@${SOURCE_DATE_EPOCH}
--clamp-mtime"
+ fi
+
+ tar ${TAR_COMPRESSION_OPT} ${TAR_SOURCE_DATE_OPTS} --owner=Guest:501
--group=None:513 -cvf "$@"
}
__pkg_binpkg() {
diff --git a/lib/src_postinst.cygpart b/lib/src_postinst.cygpart
index dd947311..f0ab0f8b 100644
--- a/lib/src_postinst.cygpart
+++ b/lib/src_postinst.cygpart
@@ -775,6 +775,11 @@ __prepman() {
while read -d $'\0' manpage
do
echo " ${manpage##*/}";
+ if [ -n "${SOURCE_DATE_EPOCH}" ]
+ then
+ # Ensure that the timestamp in gzip header is
reproducible
+ touch -d @${SOURCE_DATE_EPOCH} "${manpage}"
+ fi
gzip -q "${manpage}";
done
fi
@@ -989,6 +994,12 @@ __prepstrip_one() {
objdump=${objcopy/copy/dump}
+ if [ -n "${SOURCE_DATE_EPOCH}" ]
+ then
+ # Let objcopy preserve the timestamps
+ objcopy+=" --enable-deterministic-archives --preserve-dates"
+ fi
+
# Static libraries should not be fully stripped, but we can
# still provide split debuginfo if desired
case "${exe}" in
@@ -1074,6 +1085,16 @@ __prepstrip_one() {
# keep sticky bit if present
chmod u+w,a+x "${exe}";
+ if [ -n "${SOURCE_DATE_EPOCH}" ]
+ then
+ case "${exe}" in
+ *.exe|*.dll|*.so|*.so.*|*.oct|*.mex|*.cmxs)
+ # Ensure PE header timestamp is reproducible and
checksum is correct
+ # objcopy later inherits the timestamp to debug info
and stripped file
+ peflags --checksum=1 --timestamp=${SOURCE_DATE_EPOCH}
${exe} >/dev/null ;;
+ esac
+ fi
+
if defined _CYGPORT_RESTRICT_debuginfo_
then
${objcopy} --strip-all "${exe}";
--
2.39.0
