-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
script/release.sh: make builds reproducible #3099
Conversation
CI failure in centos 7 is a glitch (hope we'll merge #3088 soon and see less of those failures). CI restarted.
|
a351a3c
to
b1f95ae
Compare
This patch * drops the default `-w` flag for `make static`, which helps with debugging the static runc binary; * adds `EXTRA_LDFLAGS="-w -s"` to `script/release.sh` to disable DWARF generation and symbol table for the release runc binary; * adds strip in `script/release.sh` for a further size-optimized release runc binary. Signed-off-by: Kailun Qin <kailun.qin@intel.com>
What it takes is add an empty buildid, which, together with previously added strip invocation, results in reproducible build! NB: earlier versions of this patch also added the following: 1. non-random libseccomp install $prefix; 2. "objcopy --enable-deterministic-archives $prefix/lib/libseccomp.a" to strip ar dates and UIDs/GIDs; 3. "-B=0x00" to EXTRA_LDFLAGS to have non-variable NT_GNU_BUILD_ID. Apparently, all this is not needed with strip. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
b1f95ae
to
18f434e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. :D
This might be nice to backport to 1.0.x if we plan to do another release, just to make sure all future releases are reproducible. |
Done: #3142 |
Carries #3054 (thanks to @kailun-qin).
What it takes is add an empty buildid, which, together with previously
added
strip
invocation, results in reproducible build!NB: earlier versions of this patch also added the following:
$prefix
;objcopy --enable-deterministic-archives $prefix/lib/libseccomp.a
to strip ar dates and UIDs/GIDs;
-B=0x00
toEXTRA_LDFLAGS
to have non-variable NT_GNU_BUILD_ID.Apparently, all this is not needed with
strip
in place.Fixes: #2947.
Closes: #3054.
1.0 backport: #3142