virtio-linux: pin KBUILD_BUILD_* for reproducible kernel image

[bryan-minimal]

What

Pins the kernel's embedded build metadata so the virtio-linux image is reproducible.

Why

The Linux kernel bakes build time, user, and host into the image (via scripts/mkcompile_h, surfaced in /proc/version), so vmlinuz differed byte-for-byte across otherwise-identical rebuilds. Setting the standard KBUILD_BUILD_* variables makes those fields deterministic (timestamp derived from SOURCE_DATE_EPOCH, defaulting to epoch 0).

export KBUILD_BUILD_TIMESTAMP="@${SOURCE_DATE_EPOCH:-0}"
export KBUILD_BUILD_USER=builder
export KBUILD_BUILD_HOST=minimal

Verification

Verified with a build-twice-and-diff on aarch64: two from-scratch forced rebuilds (--rebuild --no-fetch) produced byte-identical output (3/3 files identical). Before this change the image diverged on the embedded timestamp/user/host.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved kernel build reproducibility to ensure builds are deterministic and consistent across environments.

[coderabbitai]

📝 Walkthrough

Walkthrough

packages/virtio-linux/build.sh gains three exported environment variables (KBUILD_BUILD_TIMESTAMP, KBUILD_BUILD_USER, KBUILD_BUILD_HOST) that pin kernel build metadata to fixed values, making kernel outputs reproducible. SOURCE_DATE_EPOCH is used for the timestamp with a fallback of 0.

Changes

Kernel Build Reproducibility

Layer / File(s)	Summary
KBUILD reproducibility env vars packages/virtio-linux/build.sh	Adds exports for KBUILD_BUILD_TIMESTAMP (sourced from SOURCE_DATE_EPOCH with default 0), KBUILD_BUILD_USER (builder), and KBUILD_BUILD_HOST (minimal) before kernel config/build steps.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐇 Hoppity-hop, the kernel shall freeze,
No timestamp drift on the midnight breeze!
builder the user, minimal the host,
Reproducible bits — that's what matters most.
Same bytes each time, as sure as my ears! 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'virtio-linux: pin KBUILD_BUILD_* for reproducible kernel image' directly and clearly summarizes the main change: pinning kernel build metadata variables to achieve reproducibility.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bryan/virtio-linux-reproducible

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/virtio-linux/build.sh`:
- Around line 10-12: The KBUILD_BUILD_TIMESTAMP export depends on ambient
SOURCE_DATE_EPOCH environment variable which breaks byte-for-byte
reproducibility across different build environments. Fix this by changing
KBUILD_BUILD_TIMESTAMP to use a fixed value `@0` instead of the conditional
@${SOURCE_DATE_EPOCH:-0} expression. Additionally, add the missing environment
variable exports for SOURCE_DATE_EPOCH=0 and PYTHONHASHSEED=0 to ensure
deterministic Python-based build steps and embedded timestamps, ensuring all
reproducibility variables are pinned to fixed values within the script itself.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: adccf3f1-1036-4ce4-a0e3-9d1638c68bcf

📥 Commits

Reviewing files that changed from the base of the PR and between 5d86c06 and 229b1ba.

📒 Files selected for processing (1)

• packages/virtio-linux/build.sh

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin kernel reproducibility vars to fixed values inside the script.

KBUILD_BUILD_TIMESTAMP currently depends on ambient SOURCE_DATE_EPOCH (Line 10), which can vary per build environment and break byte-for-byte reproducibility. Also, the deterministic timestamp/Python env exports are missing.

Suggested patch

 export KBUILD_BUILD_TIMESTAMP="@${SOURCE_DATE_EPOCH:-0}"
 export KBUILD_BUILD_USER=builder
 export KBUILD_BUILD_HOST=minimal
+export SOURCE_DATE_EPOCH=0
+export PYTHONHASHSEED=0
+export KBUILD_BUILD_TIMESTAMP=`@0`

As per coding guidelines: “For Linux kernel builds, export KBUILD_BUILD_TIMESTAMP=@0 KBUILD_BUILD_USER=builder KBUILD_BUILD_HOST=minimal” and “For embedded timestamps and Python-based build steps, export SOURCE_DATE_EPOCH=0 and PYTHONHASHSEED=0.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/virtio-linux/build.sh` around lines 10 - 12, The
KBUILD_BUILD_TIMESTAMP export depends on ambient SOURCE_DATE_EPOCH environment
variable which breaks byte-for-byte reproducibility across different build
environments. Fix this by changing KBUILD_BUILD_TIMESTAMP to use a fixed value
`@0` instead of the conditional @${SOURCE_DATE_EPOCH:-0} expression. Additionally,
add the missing environment variable exports for SOURCE_DATE_EPOCH=0 and
PYTHONHASHSEED=0 to ensure deterministic Python-based build steps and embedded
timestamps, ensuring all reproducibility variables are pinned to fixed values
within the script itself.

Source: Coding guidelines