[PATCH 0/4] fontcache: make the caches built into an image valid

[PATCH 0/4] fontcache: make the caches built into an image valid

[Alex Kiernan]

The fontconfig caches update_font_cache builds into an image are never
used on the target. fontconfig accepts a cache only while the directory
mtime it recorded matches the directory, and three things disagree about
that mtime:

- fc-cache records min(directory mtime, SOURCE_DATE_EPOCH). When the
  intercept runs, the font directories still carry their packages'
  mtimes and SOURCE_DATE_EPOCH is the image's fallback value.
- reproducible_final_image_task then sets every mtime in the rootfs to
  REPRODUCIBLE_TIMESTAMP_ROOTFS.
- mke2fs clamps every inode time to the SOURCE_DATE_EPOCH in its
  environment, so an ext image ends up with a different time again from
  a tar or squashfs image of the same rootfs.

So every process using fonts rescans and writes a cache of its own, or
fails to on a read-only rootfs. fc-cache also deletes a cache it has
just written for a directory newer than SOURCE_DATE_EPOCH, so with the
default values some caches are missing from the image entirely.

Patches 1-2 run fc-cache under REPRODUCIBLE_TIMESTAMP_ROOTFS, with the
font directories' mtimes already set to it. Patch 3 keeps that time in ext
images, as oe_mksquashfs already does for squashfs. That moves every
inode and superblock time in an ext image from
SOURCE_DATE_EPOCH_FALLBACK to REPRODUCIBLE_TIMESTAMP_ROOTFS, which with
the bitbake.conf defaults is from 2011-04-05 to 2018-03-09. Patch 4
adds a selftest that boots an image carrying a font and checks that
fontconfig accepts every cache and writes none. On qemuarm64 it fails
without patches 1-3 and passes with them.

---
Alex Kiernan (4):
      package_manager: pass REPRODUCIBLE_TIMESTAMP_ROOTFS to intercepts
      update_font_cache: write caches that are valid in the final image
      image_types: keep the rootfs mtimes in ext2/3/4 images
      oeqa/selftest: check the font caches an image ships are used

 meta/classes-recipe/fontcache.bbclass         |  1 +
 meta/classes-recipe/image_types.bbclass       |  6 ++++
 meta/lib/oe/package_manager/__init__.py       |  6 ++++
 meta/lib/oeqa/selftest/cases/fontcache.py     | 42 +++++++++++++++++++++++++++
 scripts/postinst-intercepts/update_font_cache | 12 +++++++-
 5 files changed, 66 insertions(+), 1 deletion(-)
---
base-commit: 6b2dcfdbe16055edc88f72dabf07e33f8163d8eb
change-id: 20261013-fontcache-reproducible-mtime-f03aa3135def

Best regards,
--  
Alex Kiernan <alex.kiernan@gmail.com>

[PATCH 1/4] package_manager: pass REPRODUCIBLE_TIMESTAMP_ROOTFS to intercepts

[Alex Kiernan]

do_rootfs marks REPRODUCIBLE_TIMESTAMP_ROOTFS for export, but that only
reaches the shell functions it emits afterwards. The task's environment
is fixed when it starts, so the postinst intercepts, which run from it,
never see the timestamp every file in the image will end up with. Set it
alongside D and STAGING_DIR_NATIVE.

AI-Generated: Claude Opus 5.5 (Claude Code)
---
 meta/lib/oe/package_manager/__init__.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/meta/lib/oe/package_manager/__init__.py b/meta/lib/oe/package_manager/__init__.py
index 88bc5ab19520..76289c911b0b 100644
--- a/meta/lib/oe/package_manager/__init__.py
+++ b/meta/lib/oe/package_manager/__init__.py
@@ -223,6 +223,12 @@ class PackageManager(object, metaclass=ABCMeta):
         bb.note("Running intercept scripts:")
         os.environ['D'] = self.target_rootfs
         os.environ['STAGING_DIR_NATIVE'] = self.d.getVar('STAGING_DIR_NATIVE')
+        # The mtime every file in the image will end with; intercepts that
+        # record an mtime need it, and do_rootfs only exports it to shell
+        # functions it emits, not to the environment they run in.
+        timestamp = self.d.getVar('REPRODUCIBLE_TIMESTAMP_ROOTFS')
+        if timestamp:
+            os.environ['REPRODUCIBLE_TIMESTAMP_ROOTFS'] = timestamp
         for script in os.listdir(intercepts_dir):
             script_full = os.path.join(intercepts_dir, script)
 

-- 
2.43.0

[PATCH 2/4] update_font_cache: write caches that are valid in the final image

[Alex Kiernan]

fontconfig accepts a directory's cache only while the mtime recorded in
it matches the directory, and fc-cache records the mtime clamped to
SOURCE_DATE_EPOCH. The intercept runs with the image's
SOURCE_DATE_EPOCH, against font directories that still carry their
packages' mtimes, and reproducible_final_image_task later sets every
mtime in the image to REPRODUCIBLE_TIMESTAMP_ROOTFS. The recorded and
final mtimes never match, so on the target every cache the image ships
is rejected and each process using fontconfig rescans the fonts and
writes a cache of its own.

When REPRODUCIBLE_TIMESTAMP_ROOTFS is set, set the mtime of every
directory under ${datadir}/fonts to it before running fc-cache, and run
fc-cache with it as SOURCE_DATE_EPOCH, so the caches record the mtimes
the image ships with.

AI-Generated: Claude Opus 5.5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
---
 meta/classes-recipe/fontcache.bbclass         |  1 +
 scripts/postinst-intercepts/update_font_cache | 12 +++++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/fontcache.bbclass b/meta/classes-recipe/fontcache.bbclass
index deadcd2fbbeb..37ff7d7cbc7e 100644
--- a/meta/classes-recipe/fontcache.bbclass
+++ b/meta/classes-recipe/fontcache.bbclass
@@ -28,6 +28,7 @@ if [ -n "$D" ] ; then
 		'libdir="${libdir}"' \
 		'libexecdir="${libexecdir}"' \
 		'base_libdir="${base_libdir}"' \
+		'datadir="${datadir}"' \
 		'fontconfigcachedir="${FONTCONFIG_CACHE_DIR}"' \
 		'fontconfigcacheparams="${FONTCONFIG_CACHE_PARAMS}"' \
 		'fontconfigcacheenv="${FONTCONFIG_CACHE_ENV}"'
diff --git a/scripts/postinst-intercepts/update_font_cache b/scripts/postinst-intercepts/update_font_cache
index 900db042d64e..5098b2890cc8 100644
--- a/scripts/postinst-intercepts/update_font_cache
+++ b/scripts/postinst-intercepts/update_font_cache
@@ -7,7 +7,17 @@ set -e
 
 rm -f $D${fontconfigcachedir}/CACHEDIR.TAG
 
-PSEUDO_UNLOAD=1 ${binprefix}qemuwrapper -L $D -E ${fontconfigcacheenv} $D${libexecdir}/${binprefix}fc-cache --sysroot=$D --system-only ${fontconfigcacheparams}
+# fontconfig only uses a cache while the mtime it recorded for a font
+# directory, clamped to SOURCE_DATE_EPOCH, matches the directory. Every
+# mtime in the image is set to REPRODUCIBLE_TIMESTAMP_ROOTFS later, so set
+# the font directories' mtimes to it now and have fc-cache record that.
+sde=
+if [ -n "$REPRODUCIBLE_TIMESTAMP_ROOTFS" ] && [ -d $D${datadir}/fonts ]; then
+	find $D${datadir}/fonts -type d -exec touch -h --date=@$REPRODUCIBLE_TIMESTAMP_ROOTFS '{}' +
+	sde="-E SOURCE_DATE_EPOCH=$REPRODUCIBLE_TIMESTAMP_ROOTFS"
+fi
+
+PSEUDO_UNLOAD=1 ${binprefix}qemuwrapper -L $D -E ${fontconfigcacheenv} $sde $D${libexecdir}/${binprefix}fc-cache --sysroot=$D --system-only ${fontconfigcacheparams}
 
 chown -R root:root $D${fontconfigcachedir}
 find $D -type f -name .uuid -exec chown root:root '{}' +

-- 
2.43.0

[PATCH 3/4] image_types: keep the rootfs mtimes in ext2/3/4 images

[Alex Kiernan]

mke2fs reads SOURCE_DATE_EPOCH from the environment and clamps the time
of every inode it creates to it. bitbake exports the image's
SOURCE_DATE_EPOCH, which is older than the REPRODUCIBLE_TIMESTAMP_ROOTFS
that reproducible_final_image_task gives every file, so an ext image
carries different mtimes from a tar or squashfs image of the same rootfs,
and anything recorded against the rootfs mtimes, such as the fontconfig
caches, is wrong in it.

Give mke2fs the rootfs mtime instead, as oe_mksquashfs does for
mksquashfs. It is just as fixed, so the image stays reproducible.

This changes the times stamped into an ext image. Every inode's atime,
ctime, mtime and crtime, and the superblock's created, last write and
last checked times, move from the image's SOURCE_DATE_EPOCH to
REPRODUCIBLE_TIMESTAMP_ROOTFS. An image recipe has no source of its own,
so its SOURCE_DATE_EPOCH is SOURCE_DATE_EPOCH_FALLBACK; with the
bitbake.conf defaults for that and REPRODUCIBLE_TIMESTAMP_ROOTFS, the
times move from 1302044400 (2011-04-05) to 1520598896 (2018-03-09).

Where a distro sets REPRODUCIBLE_TIMESTAMP_ROOTFS earlier than
SOURCE_DATE_EPOCH the inode times were not clamped and only the
superblock times change. The directory hash seed is still derived from
SOURCE_DATE_EPOCH and does not change. An ext image therefore differs
from one built before this change.

AI-Generated: Claude Opus 5.5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
---
 meta/classes-recipe/image_types.bbclass | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/meta/classes-recipe/image_types.bbclass b/meta/classes-recipe/image_types.bbclass
index c0b3a780131e..a5637c2226c8 100644
--- a/meta/classes-recipe/image_types.bbclass
+++ b/meta/classes-recipe/image_types.bbclass
@@ -92,6 +92,12 @@ oe_mkext234fs () {
 		extra_imagecmd=$@
 	fi
 
+	# mke2fs reads SOURCE_DATE_EPOCH itself and clamps every inode time to it,
+	# so give it the time the rootfs files carry, as oe_mksquashfs does.
+	if [ -n "$SOURCE_DATE_EPOCH" ]; then
+		export SOURCE_DATE_EPOCH=$(stat -c '%Y' ${IMAGE_ROOTFS})
+	fi
+
 	# For reproducible builds, make mke2fs/e2fsck deterministic: a fixed time and
 	# directory hash seed (the fsck "-D" pass reorders directories using it).
 	# This mirrors what wic does for its ext4 partitions.

-- 
2.43.0

[PATCH 4/4] oeqa/selftest: check the font caches an image ships are used

[Alex Kiernan]

Boot an image carrying a font and have fontconfig report the caches it
checks: every one must match its directory, and nothing may be written,
neither to the system cache nor to a per-user one.

AI-Generated: Claude Opus 5.5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
---
 meta/lib/oeqa/selftest/cases/fontcache.py | 42 +++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/meta/lib/oeqa/selftest/cases/fontcache.py b/meta/lib/oeqa/selftest/cases/fontcache.py
new file mode 100644
index 000000000000..df88a229aab2
--- /dev/null
+++ b/meta/lib/oeqa/selftest/cases/fontcache.py
@@ -0,0 +1,42 @@
+#
+# Copyright OpenEmbedded Contributors
+#
+# SPDX-License-Identifier: MIT
+#
+
+import re
+
+from oeqa.selftest.case import OESelftestTestCase
+from oeqa.core.decorator import OETestTag
+from oeqa.utils.commands import bitbake, runqemu
+
+class FontCache(OESelftestTestCase):
+
+    @OETestTag("runqemu")
+    def test_image_font_cache_is_valid(self):
+        """
+        Summary:  Check the fontconfig caches built into an image are used
+        Expected: fontconfig accepts the cache of every font directory and
+                  writes no cache of its own, system or per-user
+        Product:  oe-core
+        """
+        features = 'EXTRA_IMAGE_FEATURES = "empty-root-password allow-empty-password allow-root-login"\n'
+        features += 'IMAGE_INSTALL:append = " ttf-bitstream-vera"\n'
+        self.write_config(features)
+        bitbake('core-image-minimal')
+
+        with runqemu('core-image-minimal') as qemu:
+            # FC_DEBUG=16 reports each cache fontconfig checks and each one it
+            # writes. An empty HOME catches a per-user cache, which fontconfig
+            # writes whenever it cannot use the system one.
+            status, output = qemu.run_serial(
+                'H=$(mktemp -d); HOME=$H XDG_CACHE_HOME=$H FC_DEBUG=16 fc-match sans-serif; echo "user cache: [$(ls -A $H)]"')
+            self.assertEqual(status, 1, msg=output)
+
+            checks = re.findall(r'FcCacheTimeValid dir "([^"]+)" cache checksum (\d+) dir checksum (\d+)', output)
+            self.assertTrue(checks, msg="fontconfig checked no cache:\n" + output)
+            for directory, cache, mtime in checks:
+                self.assertEqual(cache, mtime, msg="%s: the cache records mtime %s, the directory has %s\n%s" % (directory, cache, mtime, output))
+
+            self.assertNotIn('FcDirCacheWriteDir', output, msg="fontconfig rewrote a cache:\n" + output)
+            self.assertIn('user cache: []', output, msg="fontconfig wrote a per-user cache:\n" + output)

-- 
2.43.0

Re: [PATCH 0/4] fontcache: make the caches built into an image valid

[Paul Barker]

On Tue Oct 13, 2026 at 11:49 AM BST, Alex Kiernan wrote:
> The fontconfig caches update_font_cache builds into an image are never
> used on the target. fontconfig accepts a cache only while the directory
> mtime it recorded matches the directory, and three things disagree about
> that mtime:
>
> - fc-cache records min(directory mtime, SOURCE_DATE_EPOCH). When the
>   intercept runs, the font directories still carry their packages'
>   mtimes and SOURCE_DATE_EPOCH is the image's fallback value.
> - reproducible_final_image_task then sets every mtime in the rootfs to
>   REPRODUCIBLE_TIMESTAMP_ROOTFS.
> - mke2fs clamps every inode time to the SOURCE_DATE_EPOCH in its
>   environment, so an ext image ends up with a different time again from
>   a tar or squashfs image of the same rootfs.
>
> So every process using fonts rescans and writes a cache of its own, or
> fails to on a read-only rootfs. fc-cache also deletes a cache it has
> just written for a directory newer than SOURCE_DATE_EPOCH, so with the
> default values some caches are missing from the image entirely.
>
> Patches 1-2 run fc-cache under REPRODUCIBLE_TIMESTAMP_ROOTFS, with the
> font directories' mtimes already set to it. Patch 3 keeps that time in ext
> images, as oe_mksquashfs already does for squashfs. That moves every
> inode and superblock time in an ext image from
> SOURCE_DATE_EPOCH_FALLBACK to REPRODUCIBLE_TIMESTAMP_ROOTFS, which with
> the bitbake.conf defaults is from 2011-04-05 to 2018-03-09. Patch 4
> adds a selftest that boots an image carrying a font and checks that
> fontconfig accepts every cache and writes none. On qemuarm64 it fails
> without patches 1-3 and passes with them.

Hi Alex,

If the selftest case in patch 4 is ran without the other changes in this
series, does it fail? I'd like to confirm that this test case would
catch the failure case.

Thanks,

-- 
Paul Barker

Re: [PATCH 0/4] fontcache: make the caches built into an image valid

[Alex Kiernan]

On Mon, Nov 9, 2026 at 2:20 PM Paul Barker <paul@pbarker.dev> wrote:
>
> On Tue Oct 13, 2026 at 11:49 AM BST, Alex Kiernan wrote:
> > The fontconfig caches update_font_cache builds into an image are never
> > used on the target. fontconfig accepts a cache only while the directory
> > mtime it recorded matches the directory, and three things disagree about
> > that mtime:
> >
> > - fc-cache records min(directory mtime, SOURCE_DATE_EPOCH). When the
> >   intercept runs, the font directories still carry their packages'
> >   mtimes and SOURCE_DATE_EPOCH is the image's fallback value.
> > - reproducible_final_image_task then sets every mtime in the rootfs to
> >   REPRODUCIBLE_TIMESTAMP_ROOTFS.
> > - mke2fs clamps every inode time to the SOURCE_DATE_EPOCH in its
> >   environment, so an ext image ends up with a different time again from
> >   a tar or squashfs image of the same rootfs.
> >
> > So every process using fonts rescans and writes a cache of its own, or
> > fails to on a read-only rootfs. fc-cache also deletes a cache it has
> > just written for a directory newer than SOURCE_DATE_EPOCH, so with the
> > default values some caches are missing from the image entirely.
> >
> > Patches 1-2 run fc-cache under REPRODUCIBLE_TIMESTAMP_ROOTFS, with the
> > font directories' mtimes already set to it. Patch 3 keeps that time in ext
> > images, as oe_mksquashfs already does for squashfs. That moves every
> > inode and superblock time in an ext image from
> > SOURCE_DATE_EPOCH_FALLBACK to REPRODUCIBLE_TIMESTAMP_ROOTFS, which with
> > the bitbake.conf defaults is from 2011-04-05 to 2018-03-09. Patch 4
> > adds a selftest that boots an image carrying a font and checks that
> > fontconfig accepts every cache and writes none. On qemuarm64 it fails
> > without patches 1-3 and passes with them.
>
> Hi Alex,
>
> If the selftest case in patch 4 is ran without the other changes in this
> series, does it fail? I'd like to confirm that this test case would
> catch the failure case.
>

Hi Paul

It does, and did - that's how I found the ext2/3/4 case, initially I
just had the squashfs code, which covered my use case, but it failed
when I built for qemu.

I'll go & rerun it to double check just in case anything else has
moved since then.

-- 
Alex Kiernan

Re: [OE-core] [PATCH 0/4] fontcache: make the caches built into an image valid

[Alex Kiernan]

On Mon, Nov 9, 2026 at 2:57 PM Alex Kiernan via openembedded-core
<alex.kiernan=gmail.com@lists.openembedded.org> wrote:
>
> On Mon, Nov 9, 2026 at 2:20 PM Paul Barker <paul@pbarker.dev> wrote:
> >
> > On Tue Oct 13, 2026 at 11:49 AM BST, Alex Kiernan wrote:
> > > The fontconfig caches update_font_cache builds into an image are never
> > > used on the target. fontconfig accepts a cache only while the directory
> > > mtime it recorded matches the directory, and three things disagree about
> > > that mtime:
> > >
> > > - fc-cache records min(directory mtime, SOURCE_DATE_EPOCH). When the
> > >   intercept runs, the font directories still carry their packages'
> > >   mtimes and SOURCE_DATE_EPOCH is the image's fallback value.
> > > - reproducible_final_image_task then sets every mtime in the rootfs to
> > >   REPRODUCIBLE_TIMESTAMP_ROOTFS.
> > > - mke2fs clamps every inode time to the SOURCE_DATE_EPOCH in its
> > >   environment, so an ext image ends up with a different time again from
> > >   a tar or squashfs image of the same rootfs.
> > >
> > > So every process using fonts rescans and writes a cache of its own, or
> > > fails to on a read-only rootfs. fc-cache also deletes a cache it has
> > > just written for a directory newer than SOURCE_DATE_EPOCH, so with the
> > > default values some caches are missing from the image entirely.
> > >
> > > Patches 1-2 run fc-cache under REPRODUCIBLE_TIMESTAMP_ROOTFS, with the
> > > font directories' mtimes already set to it. Patch 3 keeps that time in ext
> > > images, as oe_mksquashfs already does for squashfs. That moves every
> > > inode and superblock time in an ext image from
> > > SOURCE_DATE_EPOCH_FALLBACK to REPRODUCIBLE_TIMESTAMP_ROOTFS, which with
> > > the bitbake.conf defaults is from 2011-04-05 to 2018-03-09. Patch 4
> > > adds a selftest that boots an image carrying a font and checks that
> > > fontconfig accepts every cache and writes none. On qemuarm64 it fails
> > > without patches 1-3 and passes with them.
> >
> > Hi Alex,
> >
> > If the selftest case in patch 4 is ran without the other changes in this
> > series, does it fail? I'd like to confirm that this test case would
> > catch the failure case.
> >
>
> Hi Paul
>
> It does, and did - that's how I found the ext2/3/4 case, initially I
> just had the squashfs code, which covered my use case, but it failed
> when I built for qemu.
>
> I'll go & rerun it to double check just in case anything else has
> moved since then.
>

Yes, fails with just the test case commit cherry-picked:

2026-11-09 15:44:50,879 - oe-selftest - INFO - Ran 1 test in 218.834s
2026-11-09 15:44:50,879 - oe-selftest - INFO - FAILED
2026-11-09 15:44:50,879 - oe-selftest - INFO -  (failures=1)
NOTE: Starting bitbake server...
2026-11-09 15:44:54,103 - oe-selftest - INFO - RESULTS:
2026-11-09 15:44:54,103 - oe-selftest - INFO - RESULTS -
fontcache.FontCache.test_image_font_cache_is_valid: FAILED (217.83s)
2026-11-09 15:44:54,105 - oe-selftest - INFO - SUMMARY:
2026-11-09 15:44:54,105 - oe-selftest - INFO - oe-selftest () - Ran 1
test in 218.837s
2026-11-09 15:44:54,105 - oe-selftest - INFO - oe-selftest - FAIL -
Required tests failed (successes=0, skipped=0, failures=1, errors=0)

-- 
Alex Kiernan