From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][kirkstone 26/38] do_package/sstate/sstatesig: Change timestamp clamping to hash output only
Date: Wed, 4 Dec 2024 09:53:53 -0800 [thread overview]
Message-ID: <0c93bb692b39af51f0ca109dfd1f949abe7eea9c.1733334655.git.steve@sakoman.com> (raw)
In-Reply-To: <cover.1733334655.git.steve@sakoman.com>
From: Richard Purdie <richard.purdie@linuxfoundation.org>
The code was changing the timestamps of the files in the do_package output,
particularly the files added for debug sources. This was to do two things:
a) make do_package sstate more reproducible
b) ensure better hash equivalence matching
Unfortuately the debug source files are hardlinks into the source tree for
efficiency so touching these, touches a lot of files in ${B} and ${S}. This
causes unpredictable effects if compile is run again for example, or could
cause compiling in the install task.
The hash equivalence matching is of key importance but we can mimic that
using clamping of the file timestamps in the depsig output used to generate
the hashes.
This patch drops the global timestamp clamping, instead allowing the files
to retain their creation timestamps into sstate. This makes do_package sstate
slightly less reproducibile. We could clamp the sstate timestamps but that
would lead to two different sets of timestamps depending on whether the
data came from sstate or not. I'd prefer to have consistent code behaviour,
rather than differing behavhour depending on whether data came from sstate
or not.
If we wanted to have reproducibiliy and fix the "corruption" of S/B and have
consistent codepaths, the only other option would be two copies of the
sources, which could end up huge and seems the least desireable option.
This patch therefore drops the timestamp clamping in the sstate files
and tweaks the depsig data generation to clamp the timestamps for do_package
instead since this seems the best compromise.
I validated that rpm/deb/ipk files still generate correctly as before.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 475759fdab7200488b2a568b2ba1aa31a456d113)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/sstate.bbclass | 16 ----------------
meta/lib/oe/sstatesig.py | 7 ++++++-
2 files changed, 6 insertions(+), 17 deletions(-)
diff --git a/meta/classes/sstate.bbclass b/meta/classes/sstate.bbclass
index 91d42665c1..6bfccbb907 100644
--- a/meta/classes/sstate.bbclass
+++ b/meta/classes/sstate.bbclass
@@ -660,15 +660,6 @@ def sstate_package(ss, d):
tmpdir = d.getVar('TMPDIR')
- fixtime = False
- if ss['task'] == "package":
- fixtime = True
-
- def fixtimestamp(root, path):
- f = os.path.join(root, path)
- if os.lstat(f).st_mtime > sde:
- os.utime(f, (sde, sde), follow_symlinks=False)
-
sstatebuild = d.expand("${WORKDIR}/sstate-build-%s/" % ss['task'])
sde = int(d.getVar("SOURCE_DATE_EPOCH") or time.time())
d.setVar("SSTATE_CURRTASK", ss['task'])
@@ -683,8 +674,6 @@ def sstate_package(ss, d):
# to sstate tasks but there aren't many of these so better just avoid them entirely.
for walkroot, dirs, files in os.walk(state[1]):
for file in files + dirs:
- if fixtime:
- fixtimestamp(walkroot, file)
srcpath = os.path.join(walkroot, file)
if not os.path.islink(srcpath):
continue
@@ -706,11 +695,6 @@ def sstate_package(ss, d):
bb.utils.mkdirhier(plain)
bb.utils.mkdirhier(pdir)
bb.utils.rename(plain, pdir)
- if fixtime:
- fixtimestamp(pdir, "")
- for walkroot, dirs, files in os.walk(pdir):
- for file in files + dirs:
- fixtimestamp(walkroot, file)
d.setVar('SSTATE_BUILDDIR', sstatebuild)
d.setVar('SSTATE_INSTDIR', sstatebuild)
diff --git a/meta/lib/oe/sstatesig.py b/meta/lib/oe/sstatesig.py
index 30f27b0f4f..331b67c6e4 100644
--- a/meta/lib/oe/sstatesig.py
+++ b/meta/lib/oe/sstatesig.py
@@ -510,6 +510,7 @@ def OEOuthashBasic(path, sigfile, task, d):
if task == "package":
include_timestamps = True
include_root = False
+ source_date_epoch = float(d.getVar("SOURCE_DATE_EPOCH"))
hash_version = d.getVar('HASHEQUIV_HASH_VERSION')
extra_sigdata = d.getVar("HASHEQUIV_EXTRA_SIGDATA")
@@ -601,7 +602,11 @@ def OEOuthashBasic(path, sigfile, task, d):
raise Exception(msg).with_traceback(e.__traceback__)
if include_timestamps:
- update_hash(" %10d" % s.st_mtime)
+ # Need to clamp to SOURCE_DATE_EPOCH
+ if s.st_mtime > source_date_epoch:
+ update_hash(" %10d" % source_date_epoch)
+ else:
+ update_hash(" %10d" % s.st_mtime)
update_hash(" ")
if stat.S_ISBLK(s.st_mode) or stat.S_ISCHR(s.st_mode):
--
2.34.1
next prev parent reply other threads:[~2024-12-04 17:55 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-04 17:53 [OE-core][kirkstone 00/38] Patch review Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 01/38] ovmf: Fix CVE-2022-36763 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 02/38] ovmf: Fix CVE-2022-36764 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 03/38] ovmf: Fix CVE-2023-45230 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 04/38] ovmf: Fix CVE-2023-45231 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 05/38] ovmf: Fix CVE-2023-45232, CVE-2023-45233 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 06/38] ovmf: Fix CVE-2023-45234 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 07/38] ovmf: Fix CVE-2023-45235 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 08/38] ovmf: Fix CVE-2023-45229 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 09/38] ovmf: Fix CVE-2023-45237 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 10/38] ovmf: Fix CVE-2023-45236 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 11/38] ovmf: Fix CVE-2022-36765 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 12/38] ovmf: fix CVE-2024-38796 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 13/38] ovmf: fix CVE-2024-1298 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 14/38] libsoup: fix CVE-2024-52531 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 15/38] python3-zipp: fix CVE-2024-5569 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 16/38] libsoup-2.4: Backport fix for CVE-2024-52531 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 17/38] cpio: ignore CVE-2023-7216 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 18/38] gnupg: ignore CVE-2022-3515 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 19/38] qemu: ignore CVE-2022-36648 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 20/38] grub: ignore CVE-2024-1048 and CVE-2023-4001 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 21/38] pixman: ignore CVE-2023-37769 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 22/38] qemu: patch CVE-2024-6505 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 23/38] qemu: fix CVE-2024-3446 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 24/38] qemu: fix CVE-2024-3447 Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 25/38] diffoscope: fix CVE-2024-25711 Steve Sakoman
2024-12-04 17:53 ` Steve Sakoman [this message]
2024-12-04 17:53 ` [OE-core][kirkstone 27/38] rxvt-unicode.inc: disable the terminfo installation by setting TIC to : Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 28/38] selftest/reproducible: Drop rawlogs Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 29/38] selftest/reproducible: Clean up pathnames Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 30/38] resulttool: Allow store to filter to specific revisions Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 31/38] resulttool: Use single space indentation in json output Steve Sakoman
2024-12-04 17:53 ` [OE-core][kirkstone 32/38] oeqa/utils/gitarchive: Return tag name and improve exclude handling Steve Sakoman
2024-12-04 17:54 ` [OE-core][kirkstone 33/38] resulttool: Fix passthrough of --all files in store mode Steve Sakoman
2024-12-04 17:54 ` [OE-core][kirkstone 34/38] resulttool: Add --logfile-archive option to " Steve Sakoman
2024-12-04 17:54 ` [OE-core][kirkstone 35/38] resulttool: Handle ltp rawlogs as well as ptest Steve Sakoman
2024-12-04 17:54 ` [OE-core][kirkstone 36/38] resulttool: Clean up repoducible build logs Steve Sakoman
2024-12-04 17:54 ` [OE-core][kirkstone 37/38] resulttool: Trim the precision of duration information Steve Sakoman
2024-12-04 17:54 ` [OE-core][kirkstone 38/38] resulttool: Improve repo layout for oeselftest results Steve Sakoman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0c93bb692b39af51f0ca109dfd1f949abe7eea9c.1733334655.git.steve@sakoman.com \
--to=steve@sakoman.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox