Recent development versions of makepkg support reproducible builds
through the environment variable SOURCE_DATE_EPOCH. Pass this variable
through makechrootpkg to makepkg when available.
Also initialize SOURCE_DATE_EPOCH whenever running archbuild to enforce
reproducible builds for repository packages.
Signed-off-by: Eli Schwartz
---
archbuild.in | 7 ++++++-
lib/archroot.sh | 6 ++++--
makechrootpkg.in | 5 +++--
3 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/archbuild.in b/archbuild.in
index 8339aef..1e5b582 100644
--- a/archbuild.in
+++ b/archbuild.in
@@ -39,7 +39,7 @@ while getopts 'hcr:' arg; do
esac
done
-check_root
+check_root SOURCE_DATE_EPOCH
# Pass all arguments after -- right to makepkg
makechrootpkg_args+=("${@:$OPTIND}")
@@ -74,5 +74,10 @@ else
pacman -Syu --noconfirm || abort
fi
+# Always build official packages reproducibly
+if [[ ! -v SOURCE_DATE_EPOCH ]]; then
+ export SOURCE_DATE_EPOCH=$(date +%s)
+fi
+
msg "Building in chroot for [%s] (%s)..." "${repo}" "${arch}"
exec makechrootpkg -r "${chroots}/${repo}-${arch}" "${makechrootpkg_args[@]}"
diff --git a/lib/archroot.sh b/lib/archroot.sh
index 98fd2cf..f279603 100644
--- a/lib/archroot.sh
+++ b/lib/archroot.sh
@@ -6,13 +6,15 @@
CHROOT_VERSION='v4'
##
-# usage : check_root
+# usage : check_root $keepenv
##
orig_argv=("$0" "$@")
check_root() {
+ local keepenv=$1
+
(( EUID == 0 )) && return
if type -P sudo >/dev/null; then
- exec sudo -- "${orig_argv[@]}"
+ exec sudo --preserve-env=$keepenv -- "${orig_argv[@]}"
else
exec su root -c "$(printf ' %q' "${orig_argv[@]}")"
fi
diff --git a/makechrootpkg.in b/makechrootpkg.in
index be9b33f..d43a130 100644
--- a/makechrootpkg.in
+++ b/makechrootpkg.in
@@ -200,6 +200,7 @@ EOF
{
printf '#!/bin/bash\n'
declare -f _chrootbuild
+ declare -p SOURCE_DATE_EPOCH 2>/dev/null
printf '_chrootbuild "$@" || exit\n'
if [[ $run_namcap = true ]]; then
@@ -226,7 +227,7 @@ _chrootbuild() {
# use "$" in arguments to commands with "sudo -i". ${foo} or
# ${1} is OK, but $foo or $1 isn't.
# https://bugzilla.sudo.ws/show_bug.cgi?id=765
- sudo -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
+ sudo --preserve-env=SOURCE_DATE_EPOCH -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
}
_chrootnamcap() {
@@ -338,7 +339,7 @@ main() {
[[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.'
makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}}
- check_root
+ check_root SOURCE_DATE_EPOCH
# Canonicalize chrootdir, getting rid of trailing /
chrootdir=$(readlink -e "$passeddir")
--
2.15.0