git.iko.soy/typeable/nixpkgs
on master help sign in
make-initrd: fix reproducibility problems

cpio includes the number of directory hard links in archives it creates. Some filesystems, like btrfs, do not count directory hard links the same way as more common filesystems like ext4 or tmpfs, so archives built when /tmp is on such a filesystem do not reproduce. This patch replaces cpio with bsdtar, which does not have this issue. The specific invocation is from this page: https://reproducible-builds.org/docs/archives/

commit7fd6cea253a27d3c0660a4c21774c9697a655661 authorThomas Watson <twatson52@icloud.com> dateSat 26 Mar 2022, 18:34 (5 years ago) parenta9414de
3 files changed+5−5
compare with master
unifiedsplit
nixos/modules/system/boot/stage-1.nix+2−2 pkgs/build-support/kernel/make-initrd.nix+2−2 pkgs/build-support/kernel/make-initrd.sh+1−1
nixos/modules/system/boot/stage-1.nix+2−2
@@ -400,7 +400,7 @@ let
400400 ${lib.optionalString (config.boot.initrd.secrets == {})
401401 "exit 0"}
402402
403− export PATH=${pkgs.coreutils}/bin:${pkgs.cpio}/bin:${pkgs.gzip}/bin:${pkgs.findutils}/bin
403+ export PATH=${pkgs.coreutils}/bin:${pkgs.libarchive}/bin:${pkgs.gzip}/bin:${pkgs.findutils}/bin
404404
405405 function cleanup {
406406 if [ -n "$tmp" -a -d "$tmp" ]; then
@@ -420,7 +420,7 @@ let
420420 ) config.boot.initrd.secrets)
421421 }
422422
423− (cd "$tmp" && find . -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null) | \
423+ (cd "$tmp" && find . -print0 | sort -z | bsdtar --uid 0 --gid 0 -cnf - -T - | bsdtar --null -cf - --format=newc @-) | \
424424 ${compressorExe} ${lib.escapeShellArgs initialRamdisk.compressorArgs} >> "$1"
425425 '';
426426
pkgs/build-support/kernel/make-initrd.nix+2−2
@@ -18,7 +18,7 @@ let
1818 # compression type and filename extension.
1919 compressorName = fullCommand: builtins.elemAt (builtins.match "([^ ]*/)?([^ ]+).*" fullCommand) 1;
2020in
21−{ stdenvNoCC, perl, cpio, ubootTools, lib, pkgsBuildHost
21+{ stdenvNoCC, perl, libarchive, ubootTools, lib, pkgsBuildHost
2222# Name of the derivation (not of the resulting file!)
2323, name ? "initrd"
2424
@@ -82,7 +82,7 @@ in stdenvNoCC.mkDerivation rec {
8282
8383 builder = ./make-initrd.sh;
8484
85− nativeBuildInputs = [ perl cpio ]
85+ nativeBuildInputs = [ perl libarchive ]
8686 ++ lib.optional makeUInitrd ubootTools;
8787
8888 compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
pkgs/build-support/kernel/make-initrd.sh+1−1
@@ -40,7 +40,7 @@ for PREP in $prepend; do
4040 cat $PREP >> $out/initrd
4141done
4242(cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +)
43−(cd root && find * .[^.*] -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
43+(cd root && find * .[^.*] -print0 | sort -z | bsdtar --uid 0 --gid 0 -cnf - -T - | bsdtar --null -cf - --format=newc @- | eval -- $compress >> "$out/initrd")
4444
4545if [ -n "$makeUInitrd" ]; then
4646 mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img