Microsoft: build reproducible kernel in-place without a temp copy#152
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the Microsoft kernel build scripts to achieve bit-for-bit reproducible outputs without copying the source tree into a fixed temporary directory, relying instead on compiler path-remapping flags to eliminate absolute-path leakage into debug info and build IDs.
Changes:
- Remove the “copy source to fixed path” workflow and build directly in the checked-out kernel repository.
- Add
-ffile-prefix-mapmappings (source dir + build dir) viaKCFLAGS/KAFLAGSto normalize embedded paths. - Centralize the version-string stabilization (
LOCALVERSION=) while adjusting reproducibility verification output locations.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| Microsoft/nix-build.sh | Switches to in-place builds and exports path-remapping flags for reproducibility instead of copying to a fixed temp path. |
| Microsoft/build-hcl-kernel.sh | Stops injecting debug-path flags internally and relies more on caller-provided reproducibility environment. |
| Microsoft/build-hcl-kernel-pipeline.sh | Removes fixed-path copy logic and adds source/build path remapping via KCFLAGS/KAFLAGS for reproducible pipeline builds. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Build the kernel directly in its tree instead of copying the source to a fixed /tmp path and rsync-ing artifacts back. Path independence is now provided by -ffile-prefix-map, mapping the source and build directories to '.' so absolute paths no longer leak into DWARF info or the link-time GNU build-id. KAFLAGS carries the same map because assembly (.S) sources use AFLAGS, not CFLAGS. nix-build.sh exports KCFLAGS/KAFLAGS via the environment and build-hcl-kernel.sh no longer hardcodes KCFLAGS on the make command line (which would override the environment), so the normalization flags take effect. build-hcl-kernel-pipeline.sh drops its /tmp fixed-path copy (and the cleanup/copy-back) and applies the same -ffile-prefix-map in KCFLAGS and KAFLAGS. The result is an identical vmlinux regardless of the source location, verified byte-for-byte across two build paths. Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
namancse
force-pushed
the
user/namjain/repro-build-no-tmp
branch
from
cf1ecc9 to
02b9ee9
Compare
hargar19
approved these changes
Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With the necessary flags to be used to prevent different paths being embedded into the final kernel binary, there is no longer a need to copy the kernel source to same path for achieving bit by bit reproducibility. Add the necessary support and then remove the temporary copy logic.