mirrors/VeraCrypt
1
0
Fork 0
mirror of https://github.com/veracrypt/VeraCrypt.git synced 2026-08-19 13:16:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ensure reproducible builds on Linux (#1731)

Browse Source 
* ensure reproducible builds

* improve patch

* improve patch

* Narrow reproducibility scope to legacy and DEB

Keep the verified Linux legacy Makefile and DEB reproducibility paths, but remove the unverified RPM/openSUSE timestamp changes and AppImage reproducibility behavior from this PR.

The CPack mtime/mode clamp is now installed only for Debian/Ubuntu packaging, matching the scope covered by the provided reproducibility logs.

Retain umask 022 in the RPM/openSUSE wrappers so staged package permissions do not depend on a restrictive caller umask.

* Harden reproducible build cleanup

Validate SOURCE_DATE_EPOCH before interpolating it into Make, CMake or shell packaging paths.

Refuse live DESTDIR values in the CPack mtime clamp and pass makeself options through normal argv construction instead of eval.

---------

Co-authored-by: curious-rabbit <curious-rabbit@local>
Co-authored-by: Mounir IDRASSI <mounir.idrassi@amcrypto.jp>
This commit is contained in:
curious-rabbit
2026-05-18 20:54:13 +09:00
committed by GitHub
co-authored by curious-rabbit Mounir IDRASSI
parent 8b1c668b77
commit 9535e65bd8
9 changed files with 402 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Makefile
+69
View File
@@ -582,6 +582,75 @@ CFLAGS := $(C_CXX_FLAGS) $(CFLAGS) $(TC_EXTRA_CFLAGS)
CXXFLAGS := $(C_CXX_FLAGS) $(CXXFLAGS) $(TC_EXTRA_CXXFLAGS)
LFLAGS := $(LFLAGS) $(TC_EXTRA_LFLAGS)
#------ Reproducible build configuration ------
# Goal: byte-identical binaries from identical sources regardless of build
# path, build host, build user or wall-clock time.
#
# Every flag below is probed for compiler support before use, so this block
# is a safe no-op on older toolchains (VeraCrypt still supports GCC 4.x) and
# never breaks a build that would otherwise have succeeded.
#
# SOURCE_DATE_EPOCH (https://reproducible-builds.org/specs/source-date-epoch/)
# is honoured by GCC/Clang for any residual __DATE__/__TIME__ expansion, by
# ar/ranlib in deterministic mode, and by tar, gzip and makeself for archive
# member timestamps. If the caller does not set it, derive a stable value
# from the HEAD commit; fall back to a fixed constant for tarball builds with
# no git tree so that unattended builds are still deterministic.
ifndef SOURCE_DATE_EPOCH
export SOURCE_DATE_EPOCH := $(shell git -C $(BASE_DIR) log -1 --pretty=%ct 2>/dev/null || echo 1577836800)
export VC_SOURCE_DATE_EPOCH_AUTO := 1
endif
override export SOURCE_DATE_EPOCH := $(value SOURCE_DATE_EPOCH)
SOURCE_DATE_EPOCH_REMAINDER := $(value SOURCE_DATE_EPOCH)
SOURCE_DATE_EPOCH_REMAINDER := $(subst 0,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 1,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 2,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 3,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 4,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 5,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 6,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 7,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 8,,$(SOURCE_DATE_EPOCH_REMAINDER))
SOURCE_DATE_EPOCH_REMAINDER := $(subst 9,,$(SOURCE_DATE_EPOCH_REMAINDER))
ifeq "$(SOURCE_DATE_EPOCH)" ""
$(error SOURCE_DATE_EPOCH must be a non-negative Unix timestamp)
endif
ifneq "$(SOURCE_DATE_EPOCH_REMAINDER)" ""
$(error SOURCE_DATE_EPOCH must contain decimal digits only)
endif
# cc-option: return $(1) if the C compiler accepts it, empty otherwise.
cc-option = $(shell printf 'int main(void){return 0;}' | $(CC) $(1) -x c -c - -o /dev/null >/dev/null 2>&1 && echo $(1))
# Normalise build paths embedded in debug info, assertions and __FILE__ so
# the binary does not depend on where the source tree lives. -ffile-prefix-map
# needs GCC >= 8 / Clang >= 10; fall back to the older -fdebug-prefix-map
# (GCC >= 4.3) which at least normalises the path recorded in debug info.
# Linux-only block: out of scope for FreeBSD/macOS. $(abspath) because
# -ffile-prefix-map needs an absolute prefix to match.
ifeq "$(PLATFORM)" "Linux"
REPRO_BASE_DIR := $(abspath $(BASE_DIR))
REPRODUCIBLE_FLAGS := $(call cc-option,-ffile-prefix-map=$(REPRO_BASE_DIR)=.)
ifeq "$(REPRODUCIBLE_FLAGS)" ""
REPRODUCIBLE_FLAGS := $(call cc-option,-fdebug-prefix-map=$(REPRO_BASE_DIR)=.)
endif
# Drop the recorded compiler command line, which embeds absolute paths and
# host-specific options into .comment / .GCC.command.line.
REPRODUCIBLE_FLAGS += $(call cc-option,-fno-record-gcc-switches)
CFLAGS += $(REPRODUCIBLE_FLAGS)
CXXFLAGS += $(REPRODUCIBLE_FLAGS)
WXCONFIG_CFLAGS += $(REPRODUCIBLE_FLAGS)
WXCONFIG_CXXFLAGS += $(REPRODUCIBLE_FLAGS)
# Deterministic linking: pin the GNU build-id to a stable hash of the output
# instead of letting it vary with non-deterministic linker inputs. Only added
# when the linker actually accepts it.
REPRODUCIBLE_LFLAGS := $(shell printf 'int main(void){return 0;}' | $(CC) -Wl,--build-id=sha1 -x c - -o /dev/null >/dev/null 2>&1 && echo -Wl,--build-id=sha1)
LFLAGS += $(REPRODUCIBLE_LFLAGS)
endif
WX_CONFIGURE_FLAGS += -disable-shared --disable-dependency-tracking --enable-exceptions --enable-dataobj --enable-mimetype
ifdef VC_WX_MINIMAL