Skip to content

build: improve build reproducibility #8549

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sheurich wants to merge 1 commit into
base: main
Choose a base branch
from
+19 −6
Open

build: improve build reproducibility #8549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,12 @@
FROM docker.io/ubuntu:24.04 AS builder

ARG COMMIT_ID
ARG COMMIT_TIMESTAMP
ARG GO_VERSION
ARG VERSION

ENV DEBIAN_FRONTEND=noninteractive
ENV SOURCE_DATE_EPOCH=${COMMIT_TIMESTAMP}
RUN apt-get --assume-yes --no-install-recommends --update install \
ca-certificates curl gcc git gnupg2 libc6-dev

Expand All @@ -22,16 +24,18 @@ WORKDIR /opt/boulder
ENV GOBIN=/opt/boulder/bin/
RUN go install \
-buildvcs=false \
-ldflags="-X \"github.com/letsencrypt/boulder/core.BuildID=${COMMIT_ID}\" -X \"github.com/letsencrypt/boulder/core.BuildTime=$(date -u)\"" \
-trimpath \
-ldflags="-X \"github.com/letsencrypt/boulder/core.BuildID=${COMMIT_ID}\" -X \"github.com/letsencrypt/boulder/core.BuildTime=$(date -u -d @${COMMIT_TIMESTAMP})\"" \
-mod=vendor \
./...

FROM docker.io/ubuntu:24.04

ARG COMMIT_DATE_ISO8601
ARG VERSION

LABEL org.opencontainers.image.authors="Internet Security Research Group, https://letsencrypt.org/"
LABEL org.opencontainers.image.created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
LABEL org.opencontainers.image.created="${COMMIT_DATE_ISO8601}"
LABEL org.opencontainers.image.description="Boulder is an ACME-compatible X.509 Certificate Authority"
LABEL org.opencontainers.image.documentation="https://github.com/letsencrypt/boulder"
LABEL org.opencontainers.image.licenses="MPL-2.0"
Expand Down
2 changes: 1 addition & 1 deletion test/ct-test-srv/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ COPY go.mod go.sum vendor ./

COPY . .

RUN go build -o /bin/ct-test-srv ./test/ct-test-srv/main.go
RUN go build -trimpath -o /bin/ct-test-srv ./test/ct-test-srv/main.go

FROM ubuntu:24.04

Expand Down
11 changes: 8 additions & 3 deletions tools/container-build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,22 +21,27 @@ fi

ARCH="$(uname -m)"
COMMIT_ID="$(git rev-parse --short=8 HEAD)"
VERSION="${GO_VERSION}.$(date +%s)"
COMMIT_TIMESTAMP="$(git show -s --format=%ct HEAD)"
COMMIT_DATE_ISO8601="$(TZ=UTC0 git show -s --format=%cd --date=format:%Y-%m-%dT%H:%M:%SZ HEAD)"
VERSION="${GO_VERSION}.${COMMIT_TIMESTAMP}"

docker buildx build \
--file Containerfile \
--build-arg "COMMIT_ID=${COMMIT_ID}" \
--build-arg "COMMIT_TIMESTAMP=${COMMIT_TIMESTAMP}" \
--build-arg "COMMIT_DATE_ISO8601=${COMMIT_DATE_ISO8601}" \
--build-arg "GO_VERSION=${GO_VERSION}" \
--build-arg "VERSION=${VERSION}" \
--tag "boulder:${VERSION}" \
--tag "boulder:${COMMIT_ID}" \
--tag boulder \
.

docker run boulder tar -C /opt/boulder -cpz . > "./boulder-${VERSION}-${COMMIT_ID}.${ARCH}.tar.gz" .
docker run boulder tar -C /opt/boulder --mtime="@${COMMIT_TIMESTAMP}" --owner=0 --group=0 --numeric-owner --sort=name -cp . | gzip -n > "./boulder-${VERSION}-${COMMIT_ID}.${ARCH}.tar.gz"
# Produces e.g. boulder-1.25.0.1754519595-591c0545.x86_64.deb
docker run -v .:/boulderrepo \
-e "COMMIT_ID=$(git rev-parse --short=8 HEAD)" \
-e "COMMIT_ID=${COMMIT_ID}" \
-e "VERSION=${VERSION}" \
-e "SOURCE_DATE_EPOCH=${COMMIT_TIMESTAMP}" \
boulder \
/boulderrepo/tools/make-deb.sh
4 changes: 4 additions & 0 deletions tools/make-deb.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,8 @@ Homepage: https://github.com/letsencrypt/boulder
Description: Boulder is an ACME-compatible X.509 Certificate Authority
EOF

# Normalize timestamps for reproducible builds (after all files created)
find "${BUILD}" ! -type l -exec touch -d "@${SOURCE_DATE_EPOCH}" {} \;
find "${BUILD}" -type l -exec touch -h -d "@${SOURCE_DATE_EPOCH}" {} \;

dpkg-deb -Zgzip -b "${BUILD}" "boulder-${VERSION}-${COMMIT_ID}.x86_64.deb"
Loading