make cpio reproducible

[bsandu-peridio]

No description provided.

[Copilot]

Pull request overview

This PR aims to make initramfs cpio outputs reproducible by normalizing filesystem mtimes in the staged initramfs tree before the archive is created.

Changes:

• Add a build-script step that normalizes mtimes under $INITRAMFS_WORK to SOURCE_DATE_EPOCH (defaulting to 0).
• Add unit tests that assert the mtime-normalization step is emitted and ordered correctly relative to release-file injection and cpio creation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/commands/initramfs/image.rs:129

• You pin LC_ALL=C for the cpio entry sort to avoid locale-driven archive drift, but the initramfs build ID is also derived from a locale-sensitive sort of RPM NEVRAs earlier in this generated script (rpm -qa ... | sort). If the SDK/container ever gains additional locales or forwards LC_* from the host, the same package set could produce a different INITRAMFS_BUILD_ID. Consider pinning that earlier sort to LC_ALL=C as well.

    # Reproducibility notes for the pipeline below:
    #   * `LC_ALL=C sort` — entry order is archive order (and, with
    #     --renumber-inodes, decides the inode numbers), so collation must not
    #     drift. Today's SDK ships only the C/POSIX locales, which makes this a
    #     no-op, but it stops the archive from changing if the image ever gains
    #     real locales or the CLI starts forwarding the host's LC_* vars.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/commands/initramfs/image.rs:126

• xargs passes arbitrary filenames from the staged tree into touch. If any path begins with -, touch can interpret it as an option. Add -- after the touch options so all subsequent arguments are treated as paths.

        | xargs -0r touch -h -d "@${{SOURCE_DATE_EPOCH:-0}}"

[mobileoverlord]

One note on SOURCE_DATE_EPOCH, non-blocking.

The normalization pass reads ${SOURCE_DATE_EPOCH:-0}, but nothing ever sets it on this path — SdkContainer doesn't forward it into the container, and the only place it gets exported is ext/image.rs:986, inside that script's own body. So the touch is effectively hardcoded to epoch 0.

That also means the source_date_epoch config key is silently ignored here. It's wired into ext image only (ext/image.rs:572, config.source_date_epoch.unwrap_or(0)) — so a user who sets it gets it honored for extension images and quietly dropped for the initramfs. Same pre-existing gap on the rootfs side (rootfs/image.rs:182 passes -T "${SOURCE_DATE_EPOCH:-0}" to mkfs.erofs), so this PR is consistent with what's already there and I wouldn't hold it up for this.

Worth a follow-up to plumb config.source_date_epoch into the rootfs/initramfs scripts the same way, so the three image types agree. The :-0 fallback is the right default to keep either way.

Unrelated FYI while in here: the pass zeroes /usr/lib/clock-epoch, which is systemd's runtime floor for the system clock on RTC-less boards. meta-avocado's systemd still compiles in -Dtime-epoch=<build ts> (systemd_258.1.bb:209), so the floor holds and there's nothing to do — just don't turn set-time-epoch off later and expect it to survive.

[mobileoverlord]

Approving to land the LC_ALL=C pins, which are the load-bearing part — rootfs/install.rs (collation decides which kernel binary Image points at) and sdk/install.rs (preset first-match-wins decides which units end up enabled) were real latent bugs, not cosmetics.

Two follow-ups tracked separately rather than held against this PR:

• #203 purges the ~14MB of dnf/rpm state that cp -a carries into the staged tree. The cpio is not byte-reproducible without it — the rpmdb stamps INSTALLTIME/INSTALLTID per package and var/cache/dnf holds generated repodata, so mtime normalization alone doesn't get there. That PR needs to rebase so its purge sits above the touch pass here.
• SOURCE_DATE_EPOCH wiring, per my comment above.

Nit for whenever you're next in this file, not worth a round trip: the case block emits all four branches regardless of the initramfs_filesystem argument, so the format loops in test_cpio_entry_order_is_locale_independent, test_all_cpio_formats_get_normalized_tree and test_gzip_omits_timestamp assert on text that's present for every input. They read as per-format coverage but aren't — one call would do.