From de075d25c7f72c830e5f05bbacebc8d52929e49d Mon Sep 17 00:00:00 2001 From: Arnout Engelen Date: Wed, 23 Dec 2020 16:31:05 +0100 Subject: [PATCH] linux: omit build id (#106648) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Don't include an ​NT_GNU_BUILD_ID (that is randomly generated at build time). This improves the kernel reproducibility: when also disabling the MOUDLE_SIG and SECURITY_LOCKDOWN_LSM options the build is bit-by-bit reproducible. --- pkgs/os-specific/linux/kernel/manual-config.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix index 3bdb8c4f2973..9edc0ced4120 100644 --- a/pkgs/os-specific/linux/kernel/manual-config.nix +++ b/pkgs/os-specific/linux/kernel/manual-config.nix @@ -113,6 +113,13 @@ let sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g' done sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|' + + # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic. + # This way kernels can be bit-by-bit reproducible depending on settings + # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled). + # See also https://kernelnewbies.org/BuildId + sed -i Makefile -e 's|--build-id|--build-id=none|' + sed -i scripts/ld-version.sh -e "s|/usr/bin/awk|${buildPackages.gawk}/bin/awk|" '';