summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEli Schwartz <eschwartz@archlinux.org>2017-10-30 11:17:56 -0400
committerLevente Polyak <anthraxx@archlinux.org>2017-11-22 16:35:25 +0100
commiteab5aba9b027a7689acaf2382a04ff69b5b8771e (patch)
treec007465661502736d8c90b3b9c2990cf6447c4ec
parent2a308821b3de179ca1946051d7733362ed45ed04 (diff)
downloaddevtools-eab5aba9b027a7689acaf2382a04ff69b5b8771e.tar.xz
Support reproducible builds
Recent development versions of makepkg support reproducible builds through the environment variable SOURCE_DATE_EPOCH. Pass this variable through makechrootpkg to makepkg when available. Also initialize SOURCE_DATE_EPOCH whenever running archbuild to enforce reproducible builds for repository packages. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
-rw-r--r--archbuild.in7
-rw-r--r--lib/archroot.sh6
-rw-r--r--makechrootpkg.in5
3 files changed, 13 insertions, 5 deletions
diff --git a/archbuild.in b/archbuild.in
index 8339aef..1e5b582 100644
--- a/archbuild.in
+++ b/archbuild.in
@@ -39,7 +39,7 @@ while getopts 'hcr:' arg; do
esac
done
-check_root
+check_root SOURCE_DATE_EPOCH
# Pass all arguments after -- right to makepkg
makechrootpkg_args+=("${@:$OPTIND}")
@@ -74,5 +74,10 @@ else
pacman -Syu --noconfirm || abort
fi
+# Always build official packages reproducibly
+if [[ ! -v SOURCE_DATE_EPOCH ]]; then
+ export SOURCE_DATE_EPOCH=$(date +%s)
+fi
+
msg "Building in chroot for [%s] (%s)..." "${repo}" "${arch}"
exec makechrootpkg -r "${chroots}/${repo}-${arch}" "${makechrootpkg_args[@]}"
diff --git a/lib/archroot.sh b/lib/archroot.sh
index 98fd2cf..f279603 100644
--- a/lib/archroot.sh
+++ b/lib/archroot.sh
@@ -6,13 +6,15 @@
CHROOT_VERSION='v4'
##
-# usage : check_root
+# usage : check_root $keepenv
##
orig_argv=("$0" "$@")
check_root() {
+ local keepenv=$1
+
(( EUID == 0 )) && return
if type -P sudo >/dev/null; then
- exec sudo -- "${orig_argv[@]}"
+ exec sudo --preserve-env=$keepenv -- "${orig_argv[@]}"
else
exec su root -c "$(printf ' %q' "${orig_argv[@]}")"
fi
diff --git a/makechrootpkg.in b/makechrootpkg.in
index d4c293f..9253544 100644
--- a/makechrootpkg.in
+++ b/makechrootpkg.in
@@ -205,6 +205,7 @@ EOF
{
printf '#!/bin/bash\n'
declare -f _chrootbuild
+ declare -p SOURCE_DATE_EPOCH 2>/dev/null
printf '_chrootbuild "$@" || exit\n'
if $run_namcap; then
@@ -231,7 +232,7 @@ _chrootbuild() {
# use "$" in arguments to commands with "sudo -i". ${foo} or
# ${1} is OK, but $foo or $1 isn't.
# https://bugzilla.sudo.ws/show_bug.cgi?id=765
- sudo -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
+ sudo --preserve-env=SOURCE_DATE_EPOCH -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
}
_chrootnamcap() {
@@ -343,7 +344,7 @@ main() {
[[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.'
makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}}
- check_root
+ check_root SOURCE_DATE_EPOCH
# Canonicalize chrootdir, getting rid of trailing /
chrootdir=$(readlink -e "$passeddir")