From 818bb3a82939a7af88fc1a0af199d5157c61bc05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joel=20H=C3=B6ner?= Date: Mon, 10 Jun 2024 20:29:58 +0200 Subject: [PATCH] linuxPackages: consistently emit GNU build ID Other than stated in the comment on the removed code, SHA1 build IDs do not affect reproducibility. The previous code additionally didn't actually work for a lot of older kernels, because the regexp accidentally didn't apply: older kernels use `--build-id` instead of `--build-id=sha1`. --- pkgs/os-specific/linux/kernel/manual-config.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix index 0c176d3e12d9..c3680c3b73c6 100644 --- a/pkgs/os-specific/linux/kernel/manual-config.nix +++ b/pkgs/os-specific/linux/kernel/manual-config.nix @@ -170,12 +170,6 @@ let # Ensure that depmod gets resolved through PATH sed -i Makefile -e 's|= /sbin/depmod|= depmod|' - # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic. - # This way kernels can be bit-by-bit reproducible depending on settings - # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled). - # See also https://kernelnewbies.org/BuildId - sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|' - # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist. [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh