[PATCH v1] xfs: test reproducible builds

[PATCH v1] xfs: test reproducible builds

[Luca Di Maio]

With the addition of the `-p` populate option, SOURCE_DATE_EPOCH and
DETERMINISTIC_SEED support, it is possible to create fully reproducible
pre-populated filesystems. We should test them here.

Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
---
 tests/xfs/841     | 141 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/841.out |   3 +
 2 files changed, 144 insertions(+)
 create mode 100755 tests/xfs/841
 create mode 100644 tests/xfs/841.out

diff --git a/tests/xfs/841 b/tests/xfs/841
new file mode 100755
index 00000000..70c0028d
--- /dev/null
+++ b/tests/xfs/841
@@ -0,0 +1,141 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2025 Chainguard, Inc. All Rights Reserved.
+#
+# FS QA Test No. 841
+#
+# Test that XFS filesystems created with reproducibility options produce
+# identical images across multiple runs. This verifies that the combination
+# of SOURCE_DATE_EPOCH, DETERMINISTIC_SEED, and -m uuid= options result in
+# bit-for-bit reproducible filesystem images.
+
+#
+# parent pointer inject test
+#
+. ./common/preamble
+_begin_fstest auto quick parent
+
+# get standard environment, filters and checks
+. ./common/filter
+. ./common/inject
+. ./common/parent
+
+# Image file settings
+IMG_SIZE="512M"
+IMG_FILE="$TEST_DIR/xfs_reproducible_test.img"
+PROTO_DIR="$(dirname "$0")"
+
+# Fixed values for reproducibility
+FIXED_UUID="12345678-1234-1234-1234-123456789abc"
+FIXED_EPOCH="1234567890"
+
+# Check if mkfs.xfs supports required options
+_check_mkfs_xfs_options()
+{
+	local check_img="$TEST_DIR/mkfs_check.img"
+	truncate -s 64M "$check_img" || return 1
+
+	# Check -m uuid support
+	$MKFS_XFS_PROG -m uuid=00000000-0000-0000-0000-000000000000 \
+		-N "$check_img" &>/dev/null
+	local uuid_support=$?
+
+	# Check -p support (protofile/directory population)
+	$MKFS_XFS_PROG 2>&1 | grep populate &>/dev/null
+	local proto_support=$?
+
+	rm -f "$check_img"
+
+	if [ $uuid_support -ne 0 ]; then
+		_notrun "mkfs.xfs does not support -m uuid= option"
+	fi
+	if [ $proto_support -ne 0 ]; then
+		_notrun "mkfs.xfs does not support -p option for directory population"
+	fi
+}
+
+_require_test
+_check_mkfs_xfs_options
+
+# Create XFS filesystem with full reproducibility options
+# Uses -p to populate from directory during mkfs (no mount needed)
+_mkfs_xfs_reproducible()
+{
+	local img=$1
+
+	# Create fresh image file
+	rm -f "$img"
+	truncate -s $IMG_SIZE "$img" || return 1
+
+	# Set environment variables for reproducibility:
+	# - SOURCE_DATE_EPOCH: fixes all inode timestamps to this value
+	# - DETERMINISTIC_SEED: uses fixed seed (0x53454544) instead of getrandom()
+	#
+	# mkfs.xfs options:
+	# - -m uuid=: fixed filesystem UUID
+	# - -p dir: populate filesystem from directory during creation
+	SOURCE_DATE_EPOCH=$FIXED_EPOCH \
+	DETERMINISTIC_SEED=1 \
+	$MKFS_XFS_PROG \
+		-f \
+		-m uuid=$FIXED_UUID \
+		-p "$PROTO_DIR" \
+		"$img" >> $seqres.full 2>&1
+
+	return $?
+}
+
+# Compute hash of the image file
+_hash_image()
+{
+	md5sum "$1" | awk '{print $1}'
+}
+
+# Run a single reproducibility test iteration
+_run_iteration()
+{
+	local iteration=$1
+
+	echo "Iteration $iteration: Creating filesystem with -p $PROTO_DIR" >> $seqres.full
+	if ! _mkfs_xfs_reproducible "$IMG_FILE"; then
+		echo "mkfs.xfs failed" >> $seqres.full
+		return 1
+	fi
+
+	local hash=$(_hash_image "$IMG_FILE")
+	echo "Iteration $iteration: Hash = $hash" >> $seqres.full
+
+	echo $hash
+}
+
+# Verify prototype directory exists
+if [ ! -d "$PROTO_DIR" ]; then
+	_fail "Prototype directory $PROTO_DIR does not exist"
+fi
+
+echo "Test: XFS reproducible filesystem image creation"
+
+# Run three iterations
+hash1=$(_run_iteration 1)
+[ -z "$hash1" ] && _fail "Iteration 1 failed"
+
+hash2=$(_run_iteration 2)
+[ -z "$hash2" ] && _fail "Iteration 2 failed"
+
+hash3=$(_run_iteration 3)
+[ -z "$hash3" ] && _fail "Iteration 3 failed"
+
+# Verify all hashes match
+if [ "$hash1" = "$hash2" ] && [ "$hash2" = "$hash3" ]; then
+	echo "All filesystem images are identical."
+else
+	echo "ERROR: Filesystem images differ!"
+	echo "Hash 1: $hash1"
+	echo "Hash 2: $hash2"
+	echo "Hash 3: $hash3"
+	_fail "Reproducibility test failed - images are not identical"
+fi
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/841.out b/tests/xfs/841.out
new file mode 100644
index 00000000..3bdfbfda
--- /dev/null
+++ b/tests/xfs/841.out
@@ -0,0 +1,3 @@
+QA output created by 841
+Test: XFS reproducible filesystem image creation
+All filesystem images are identical.
-- 
2.52.0

Re: [PATCH v1] xfs: test reproducible builds

[Christoph Hellwig]

On Thu, Dec 11, 2025 at 06:25:31PM +0100, Luca Di Maio wrote:
> With the addition of the `-p` populate option, SOURCE_DATE_EPOCH and
> DETERMINISTIC_SEED support, it is possible to create fully reproducible
> pre-populated filesystems. We should test them here.

Cool, thanks a lot!

> +#
> +# parent pointer inject test
> +#

I don't think that is correct :)

> +. ./common/preamble
> +_begin_fstest auto quick parent

Same for the parent here.  Instead of parent mkfs is a good group here.

> +
> +# get standard environment, filters and checks

This is kinda redundand.

> +IMG_SIZE="512M"
> +IMG_FILE="$TEST_DIR/xfs_reproducible_test.img"
> +PROTO_DIR="$(dirname "$0")"

So this is basically packing up tests/generic/ in xfstests
directory.  Is that the best choice?  It won't really have non-regular
files, so the exercise might be a bit limited vs creating a directory
in $TEST_DIR and adding all file types there.

> +	# - DETERMINISTIC_SEED: uses fixed seed (0x53454544) instead of getrandom()

overly long line.

> +# Compute hash of the image file
> +_hash_image()
> +{
> +	md5sum "$1" | awk '{print $1}'

md5sum is pretty outdated.  But we're using it in all kinds of other
places in xfstests, so I think for now this is the right thing to use
here.  Eventually we should switch everything over to a more modern
checksum.

Re: [PATCH v1] xfs: test reproducible builds

[Luca Di Maio]

On Thu, Dec 11, 2025 at 09:28:01PM -0800, Christoph Hellwig wrote:
> On Thu, Dec 11, 2025 at 06:25:31PM +0100, Luca Di Maio wrote:
> > With the addition of the `-p` populate option, SOURCE_DATE_EPOCH and
> > DETERMINISTIC_SEED support, it is possible to create fully reproducible
> > pre-populated filesystems. We should test them here.
> 
> Cool, thanks a lot!
> 
> > +#
> > +# parent pointer inject test
> > +#
> 
> I don't think that is correct :)
>

Copied over from 640 :) Will fix this 

> > +. ./common/preamble
> > +_begin_fstest auto quick parent
> 
> Same for the parent here.  Instead of parent mkfs is a good group here.

Ack

> > +
> > +# get standard environment, filters and checks
> 
> This is kinda redundand.

Ack

> > +IMG_SIZE="512M"
> > +IMG_FILE="$TEST_DIR/xfs_reproducible_test.img"
> > +PROTO_DIR="$(dirname "$0")"
> 
> So this is basically packing up tests/generic/ in xfstests
> directory.  Is that the best choice?  It won't really have non-regular
> files, so the exercise might be a bit limited vs creating a directory
> in $TEST_DIR and adding all file types there.

Ack

> > +	# - DETERMINISTIC_SEED: uses fixed seed (0x53454544) instead of getrandom()
> 
> overly long line.

Ack

> > +# Compute hash of the image file
> > +_hash_image()
> > +{
> > +	md5sum "$1" | awk '{print $1}'
> 
> md5sum is pretty outdated.  But we're using it in all kinds of other
> places in xfstests, so I think for now this is the right thing to use
> here.  Eventually we should switch everything over to a more modern
> checksum.

Will move to sha256sum

Thanks for the review
L.

Re: [PATCH v1] xfs: test reproducible builds

[Christoph Hellwig]

On Fri, Dec 12, 2025 at 09:09:56AM +0100, Luca Di Maio wrote:
> > > +# Compute hash of the image file
> > > +_hash_image()
> > > +{
> > > +	md5sum "$1" | awk '{print $1}'
> > 
> > md5sum is pretty outdated.  But we're using it in all kinds of other
> > places in xfstests, so I think for now this is the right thing to use
> > here.  Eventually we should switch everything over to a more modern
> > checksum.
> 
> Will move to sha256sum

I mean stick to md5sum for now.  We should eventually migrate
all md5sum user over when introducing a new dependency anyway.
Combine that with proper helpers.  If that's something you want
to do it would be great work, but it should not be requirement
for this.

Re: [PATCH v1] xfs: test reproducible builds

[Luca Di Maio]

On Fri, Dec 12, 2025 at 12:11:46AM -0800, Christoph Hellwig wrote:
> On Fri, Dec 12, 2025 at 09:09:56AM +0100, Luca Di Maio wrote:
> > > > +# Compute hash of the image file
> > > > +_hash_image()
> > > > +{
> > > > +	md5sum "$1" | awk '{print $1}'
> > > 
> > > md5sum is pretty outdated.  But we're using it in all kinds of other
> > > places in xfstests, so I think for now this is the right thing to use
> > > here.  Eventually we should switch everything over to a more modern
> > > checksum.
> > 
> > Will move to sha256sum
> 
> I mean stick to md5sum for now.  We should eventually migrate
> all md5sum user over when introducing a new dependency anyway.
> Combine that with proper helpers.  If that's something you want
> to do it would be great work, but it should not be requirement
> for this.
> 

Sorry read this too late and v2 I've moved to sha256sum
Hopefully it's ok?

L.

Re: [PATCH v1] xfs: test reproducible builds

[Christoph Hellwig]

On Fri, Dec 12, 2025 at 05:56:02PM +0100, Luca Di Maio wrote:
> > I mean stick to md5sum for now.  We should eventually migrate
> > all md5sum user over when introducing a new dependency anyway.
> > Combine that with proper helpers.  If that's something you want
> > to do it would be great work, but it should not be requirement
> > for this.
> > 
> 
> Sorry read this too late and v2 I've moved to sha256sum
> Hopefully it's ok?

Let's ask Zorro as the maintainer.  My main issue would be adding a
new dependency, but it seems both md5sum and sha256sum are part of
coreutil and have been for a while, so we should be ok.

Re: [PATCH v1] xfs: test reproducible builds

[Luca Di Maio]

On Sun, 2025-12-14 at 21:35 -0800, Christoph Hellwig wrote:
> On Fri, Dec 12, 2025 at 05:56:02PM +0100, Luca Di Maio wrote:
> > > I mean stick to md5sum for now.  We should eventually migrate
> > > all md5sum user over when introducing a new dependency anyway.
> > > Combine that with proper helpers.  If that's something you want
> > > to do it would be great work, but it should not be requirement
> > > for this.
> > > 
> > 
> > Sorry read this too late and v2 I've moved to sha256sum
> > Hopefully it's ok?
> 
> Let's ask Zorro as the maintainer.  My main issue would be adding a
> new dependency, but it seems both md5sum and sha256sum are part of
> coreutil and have been for a while, so we should be ok.

Yes, at least on Fedora and Debian both are part of the same coreutils
package.