Reproducible builds - #300
Open
roxell wants to merge 4 commits into
Open
Conversation
We set -ffile-prefix-map=<build dir>/= to hide the build path. The trailing slash makes the map miss the compilation directory, which is the build dir itself. So DW_AT_comp_dir keeps the full path, and two builds in different build dirs are not bit by bit identical. Drop the trailing slash and map the build dir to /tuxmake. Set the same in KAFLAGS for the .S files, and keep both out of the reproducer command line. Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
modules_install creates lib/modules/<ver>/build and source. They point at the local build and source directories. The build dir is new for every build, so the symlink target changes every time and the tarball is never the same twice, even when all modules are identical. The links are broken outside the build machine anyway. Leave them out of the tarball. Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
We map the build dir, but not the source tree. Kbuild passes the source files with an absolute path, so DW_AT_name keeps it. Two builds of the same tree in different directories are then not bit by bit identical. It does not show on one machine, only when the source is somewhere else. Map the source tree as well. Keep the trailing slash here, so the file names come out relative to the tree, like an in tree build. Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
In a git worktree .git is a file that points at a directory outside the tree. We only mount the source tree, so git does not work in the container. setlocalversion finds nothing, and the kernel version loses the git part. A build from a worktree then gets 7.2.0-rc5, where the same commit in the main tree gets 7.2.0-rc5-00001-gd000866da13d. That string ends up in the kernel, so the two builds are not bit by bit identical. Mount the git dir read only. setlocalversion does not write anything. Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two builds of the same tree did not give the same artifacts. The build
dir and the source tree ended up in the debug info, the modules tarball
had a symlink to the build dir, and a build from a git worktree lost the
git part of the kernel version.
Two arm64 defconfig builds now give the same seven artifacts, vmlinux
byte for byte.
The compat vDSO needs a kernel patch too. Will send separately.