Fix build reproducibility regression from PR #2136 (musl-cross-make binutils bump) by tlaurion · Pull Request #2174 · linuxboot/heads

tlaurion · 2026-08-02T19:31:01Z

Fixes the build reproducibility regression from PR #2136
(musl-cross-make bump to 227df8b), which upgraded binutils from
2.33.1 to 2.44.

Closes: #2168. Also fixes: #2085, #2086.

Root causes

busybox — binutils regression. ld.bfd 2.44 --gc-sections uses
ASLR-influenced hash tables (no upstream fix through 2.47). Fixed:
SOURCE_DATE_EPOCH=0 + trylink patch disables --gc-sections.
gpg-agent — latent TPM-probe race exposed by cache invalidation.
gpg2's configure probes for libtss2-esys via AC_SEARCH_LIBS; the
result depends on parallel build order. The old CI cache consistently
placed gpg2 first; the binutils bump invalidated caches and reshuffled
the build schedule. Fixed: --disable-tpm2d eliminates the entire
probe chain.

Changes

modules/musl-cross-make

BUILD = x86_64-pc-linux-gnu pins config.guess
-Wa,--no-pad-sections, --with-debug-prefix-map, --enable-compressed-debug-sections=no
SOURCE_DATE_EPOCH from pinned commit epoch
SOURCES = $(packages) skips internal downloads
.sources sentinel pre-seeds tarballs before configure runs

modules/busybox + patches/

SOURCE_DATE_EPOCH=0
trylink-reproducible patch disables --gc-sections when SOURCE_DATE_EPOCH set
install.sh bypass avoids make install FORCE re-link

modules/gpg2

--disable-tpm2d removes BUILD_WITH_TPM2D/HAVE_INTEL_TSS/HAVE_LIBTSS defines

modules/linux

FORCE on modules.cpio ensures hashes.txt complete on every rebuild

Tarball downloads (fixes #2086)

fetch_source_archive.sh: --timeout=30 --tries=3 -4, audit logging
fetch_coreboot_crossgcc_archive.sh: ftpmirror.gnu.org -> mirrors.kernel.org
fetch_musl_cross_make_archive.sh: pre-seeds component tarballs into packages/

modules/qrencode (fixes #2085)

Wayback Machine URL (fukuchi.org offline)

Documentation

doc/reproducible-builds.md: all mechanisms documented
doc/index.md reorganized; cross-refs from architecture/build-freshness/
docker/modules.md

Copilot

Pull request overview

This PR targets build reproducibility for the EOL_t480-hotp-maximized board by eliminating known sources of non-determinism in the musl-cross-make toolchain build and the BusyBox link/install flow, aligning local builds with CI artifacts.

Changes:

Pin musl-cross-make build settings (BUILD triplet, assembler section padding, debug prefix mapping, debug-section compression) and propagate SOURCE_DATE_EPOCH into the toolchain build.
Patch BusyBox scripts/trylink to disable --gc-sections when SOURCE_DATE_EPOCH is set to avoid nondeterministic ld.bfd behavior.
Avoid BusyBox re-link during install by copying the built binary and running applets/install.sh directly; set SOURCE_DATE_EPOCH=0 for BusyBox builds.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
patches/busybox-1.36.1/0004-trylink-reproducible.patch	Disables BusyBox `--gc-sections` when `SOURCE_DATE_EPOCH` is set to avoid nondeterministic linking.
modules/musl-cross-make	Adds reproducibility-related config (pinned BUILD, no-pad-sections, debug prefix mapping, disables compressed debug sections) and exports `SOURCE_DATE_EPOCH` into the build.
modules/busybox	Forces `SOURCE_DATE_EPOCH=0` and changes install to avoid re-linking by using direct copy + `applets/install.sh`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tlaurion · 2026-08-02T21:10:28Z

Damn we need StageX.

tlaurion · 2026-08-03T18:34:08Z

@JonathonHall-Purism

packages: target wired to include these tarballs for Purism mirror sync

Once this PR merged, please re-seed mirror

tlaurion · 2026-08-04T21:53:44Z

Free space improvement across all constrained boards due to gpg-agent no longer linking libtss2-esys:

Board	Master free	PR free	Gain
x220-hotp-maximized	~4 KiB	~7 KiB	+2,560 bytes
t420-hotp-maximized	~2,560 bytes	~5,120 bytes	+2,560 bytes
t480-hotp-maximized	~4,538 KiB	~4,540 KiB	+2,304 bytes

tools.cpio is 22,016 bytes smaller across all boards. gpg-agent shrinks 4,096 bytes (no tpm2d linkage), offset by busybox growing 4,136 bytes (--gc-sections disabled). x220 was at 4 KiB free on master — dangerously close to CBFS overflow — now has breathing room.

tlaurion · 2026-08-04T21:56:02Z

Cold and warm builds reproducible. merging as bugfix once ci returns

tlaurion · 2026-08-04T22:04:37Z

This i really big win btw, confirmed on warm cache rebuilds:

ie: t480 board rebuild with cache restore + workspace download (no clue how to optimize better): build time : 1m 2s

tlaurion · 2026-08-04T22:09:05Z

Will say it again: we need StageX (or other reproducible focused projects), i can't keep up on bumping versions with this kind of cost. This is really not maintainership (free) friendly and actually poses the issue of wanting to NOT bump dependencies which #2135 will highlight with vulns.

Need collaboration, won't survive this pressure when #2135 merged with AI added pressure on vuln and stuff, Can foresee it.

tlaurion · 2026-08-04T22:10:36Z

this is input meanwhile for #2002 until StageX has ADA but damn, can't wait

…lete hashes.txt - Add FORCE to bzImage copy/hash rule prerequisite so warm builds always re-run the recipe that records the kernel hash in hashes.txt - Replace direct do-copy-to-target with cmp-based UNCHANGED pattern matching the modules.cpio precedent: copy to .tmp, compare, mv only when changed, print UNCHANGED when identical, always append hash/size - When unchanged, preserve mtime to prevent cascading .bundled rebuild This completes the work started in PR linuxboot#2174 (modules.cpio FORCE fix). Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…lete hashes.txt - Add FORCE to bzImage copy/hash rule prerequisite -- matching the modules.cpio fix in linuxboot#2174 -- so warm builds always re-run the recipe that records the kernel hash - Replace direct do-copy-to-target with cmp-based UNCHANGED pattern matching the modules.cpio precedent: copy to .tmp, compare, mv only when changed, print UNCHANGED when identical, always append hash/size to hashes.txt - When unchanged, preserve mtime to prevent cascading .bundled rebuild This completes the work started in PR linuxboot#2174 (modules.cpio FORCE fix). Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…ll change PR linuxboot#2174 replaced 'make install' with 'applets/install.sh --symlinks' to avoid re-linking without SOURCE_DATE_EPOCH. However, install.sh reads symlink names from busybox.links, which was not regenerated and can be missing after cache restore or make clean. Result: only the bare busybox binary was installed; all 137 applet symlinks were absent from tools.cpio, breaking the initrd. Fixes: - Regenerate busybox.links via applets/busybox.mkll before install.sh - Use include/autoconf.h (busybox 1.36.1 uses this, not config.h) - Add busybox_hostcc ?= gcc and pass HOSTCC to mkll (needed outside busybox's make context where HOSTCC is undefined) - Add test -s guard so empty link-list generation fails the build loudly instead of silently producing no symlinks Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…lete hashes.txt - Add FORCE to bzImage copy/hash rule prerequisite -- matching the modules.cpio fix in linuxboot#2174 -- so warm builds always re-run the recipe that records the kernel hash - Replace direct do-copy-to-target with cmp-based UNCHANGED pattern matching the modules.cpio precedent: copy to .tmp via plain cp -a (avoiding do-copy's misleading tmp hash output), compare, mv only when changed, print UNCHANGED when identical, always append hash/size to hashes.txt - Guard cmp with [ ! -f "$@" ] || so first build doesn't emit stderr - When unchanged, preserve mtime to prevent cascading .bundled rebuild This completes the work started in PR linuxboot#2174 (modules.cpio FORCE fix). Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…ll change PR linuxboot#2174 replaced 'make install' with 'applets/install.sh --symlinks' to avoid re-linking without SOURCE_DATE_EPOCH. However, install.sh reads symlink names from busybox.links, which was not regenerated and can be missing after cache restore or make clean. Result: only the bare busybox binary was installed; all 137 applet symlinks were absent from tools.cpio, breaking the initrd. Fixes: - Regenerate busybox.links via applets/busybox.mkll before install.sh - Use include/autoconf.h (busybox 1.36.1 uses this, not config.h) - Add busybox_hostcc ?= gcc and pass HOSTCC to mkll (needed outside busybox's make context where HOSTCC is undefined) - Add test -s guard so empty link-list generation fails the build loudly instead of silently producing no symlinks Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…hes.txt Completes the FORCE coverage work started in linuxboot#2174. tools.cpio and initrd.cpio.xz were the last two hashes.txt writers without FORCE. On warm builds, their recipes were skipped, leaving their entries (and all per-file hashes inside them) missing from hashes.txt. CI build comparison would show spurious diffs where the local side simply lacked entries, not where content diverged. - tools.cpio: add FORCE to prerequisites; recipe uses do-cpio (does not reference $^), so FORCE is safe - initrd.cpio.xz: add FORCE to prerequisites; recipe uses $^ in cpio-clean.pl input, so filter to $(filter-out FORCE,$^) to avoid passing FORCE as a filename argument With this, all cpio archives (modules, tools, heads, data, board), bzImage, and initrd.cpio.xz now have FORCE, completing the warm-build hashes.txt completeness work across every rule that writes to it. Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…ll change PR linuxboot#2174 replaced 'make install' with 'applets/install.sh --symlinks' to avoid re-linking without SOURCE_DATE_EPOCH. However, install.sh reads symlink names from busybox.links, which was not regenerated and can be missing after cache restore or make clean. Result: only the bare busybox binary was installed; all 137 applet symlinks were absent from tools.cpio, breaking the initrd. Fixes: - Regenerate busybox.links via applets/busybox.mkll before install.sh - Use include/autoconf.h (busybox 1.36.1 uses this, not config.h) - Pass HOSTCC=gcc to mkll (needed outside busybox's make context; mkll only runs the preprocessor, no cross-compilation needed) - Add test -s guard so empty link-list generation fails the build loudly instead of silently producing no symlinks Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…hes.txt Completes the FORCE coverage work started in linuxboot#2174. tools.cpio and initrd.cpio.xz were the last two hashes.txt writers without FORCE. On warm builds, their recipes were skipped, leaving their entries (and all per-file hashes inside them) missing from hashes.txt. CI build comparison would show spurious diffs where the local side simply lacked entries, not where content diverged. - tools.cpio: add FORCE to prerequisites; recipe uses do-cpio (does not reference $^), so FORCE is safe - initrd.cpio.xz: add FORCE to prerequisites; recipe uses $^ in cpio-clean.pl input, so filter to $(filter-out FORCE,$^) to avoid passing FORCE as a filename argument With this, all cpio archives (modules, tools, heads, data, board), bzImage, and initrd.cpio.xz now have FORCE, completing the warm-build hashes.txt completeness work across every rule that writes to it. Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…ll change PR linuxboot#2174 replaced 'make install' with 'applets/install.sh --symlinks' to avoid re-linking without SOURCE_DATE_EPOCH. However, install.sh reads symlink names from busybox.links, which was not regenerated and can be missing after cache restore or make clean. Result: only the bare busybox binary was installed; all 137 applet symlinks were absent from tools.cpio, breaking the initrd. Fixes: - Regenerate busybox.links via applets/busybox.mkll before install.sh - Use include/autoconf.h (busybox 1.36.1 uses this, not config.h) - Pass HOSTCC="$(heads_cc)" to mkll; mkll only runs the preprocessor (-E), where the cross-compiler is identical to host gcc for text-only header parsing and keeps the build chain self-contained (no host tools assumed) - Add test -s guard so empty link-list generation fails the build loudly instead of silently producing no symlinks Signed-off-by: Thierry Laurion <insurgo@riseup.net>