laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-22 07:48:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add reproducible build infrastructure

Browse Source 
Pin Rust toolchain to 1.94.0 via rust-toolchain.toml for deterministic
compiler output across environments. Set SOURCE_DATE_EPOCH from git
commit timestamp in CI workflows and packaging scripts to normalize
embedded timestamps.

Make packaging archives reproducible: pass --mtime=@$SOURCE_DATE_EPOCH
to tar in .deb, .ipk, and systemd tarball builds. Normalize ownership
to root:root in systemd tarballs. Pin cargo-zigbuild to 0.19.8 for
cross-compilation stability.

Add SHA-256 hash output to CI build and OpenWrt packaging workflows
for binary verification.
This commit is contained in:
Origami74
2026-03-21 03:23:20 +00:00
committed by Johnathan Corgan
parent fed6cc6987
commit c164de8808
6 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
packaging/debian/build-deb.sh
View File

@@ -19,6 +19,11 @@ if ! command -v cargo-deb &>/dev/null; then
exit 1
fi
# Derive SOURCE_DATE_EPOCH from git if not already set (reproducible builds)
if [ -z "${SOURCE_DATE_EPOCH:-}" ]; then
export SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
fi
# Build the .deb package
echo "Building .deb package..."
cargo deb

6
packaging/openwrt-ipk/build-ipk.sh
View File

@@ -244,7 +244,11 @@ fi
ipk_tar() {
# ipk_tar <output.tar.gz> <source-dir> [paths...]
local out="$1" src="$2"; shift 2
COPYFILE_DISABLE=1 "$TAR_CMD" $TAR_EXTRA_FLAGS -czf "$out" -C "$src" "$@"
local mtime_flags=""
if [ -n "${SOURCE_DATE_EPOCH:-}" ]; then
mtime_flags="--mtime=@$SOURCE_DATE_EPOCH"
fi
COPYFILE_DISABLE=1 "$TAR_CMD" $TAR_EXTRA_FLAGS $mtime_flags -czf "$out" -C "$src" "$@"
}
ipk_tar "$IPK_WORK/control.tar.gz" "$CONTROL_DIR" .

11
packaging/systemd/build-tarball.sh
View File

@@ -45,9 +45,16 @@ cp "${SCRIPT_DIR}/README.install.md" "${STAGING_DIR}/"
chmod +x "${STAGING_DIR}/install.sh" "${STAGING_DIR}/uninstall.sh"
# Create tarball
# Create tarball (reproducible: normalize timestamps and ownership)
cd "${DEPLOY_DIR}"
tar czf "${TARBALL_NAME}.tar.gz" "${TARBALL_NAME}/"
TAR_REPRO_FLAGS=""
if [ -n "${SOURCE_DATE_EPOCH:-}" ]; then
TAR_REPRO_FLAGS="--mtime=@${SOURCE_DATE_EPOCH}"
fi
if tar --version 2>/dev/null | grep -q 'GNU tar'; then
TAR_REPRO_FLAGS="${TAR_REPRO_FLAGS} --numeric-owner --owner=0 --group=0"
fi
COPYFILE_DISABLE=1 tar ${TAR_REPRO_FLAGS} -czf "${TARBALL_NAME}.tar.gz" "${TARBALL_NAME}/"
rm -rf "${STAGING_DIR}"
echo ""