[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#978946: gfxboot: reproducible builds: Embeds user id and group id in cpio files



Control: tags 978946 fixed-upstream

On 2020-12-31, Vagrant Cascadian wrote:
> Various cpio archives shipped in gfxboot contain the user id and group
> id of the build user:
>
>   https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/gfxboot.html
>
>   etc/bootsplash/example_01/cdrom/bootlogo
>
>   -rw-r--r--···1·····1111·····1111····42639·2020-12-24·13:17:48.000000·init
>   vs.
>   -rw-r--r--···1·····2222·····2222····42639·2022-01-26·19:45:05.000000·init
>
>
> The attached patch fixes this by passing the owner argument to the cpio
> calls when creating the archives.

This is fixed upstream:

  https://github.com/openSUSE/gfxboot/pull/35

> Unfortunately, the cpio archives also embed the timestamps of the files
> included, which will likely vary between builds, so this does not
> resolve all reproducibility issues with these archives.

Timestamp issues also fixed upstream in the same pull request.


I think applying similar patches to themes/examples* may still be
needed.


live well,
  vagrant

Attachment: signature.asc
Description: PGP signature


Reply to: