C9S/coopos
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

reproducible pinned builds

Browse Source
This commit is contained in:
Matt Witherspoon
2023-09-24 22:00:25 -04:00
parent 9979695228
commit dda0ff8b31
7 changed files with 148 additions and 277 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/pinned_build.yaml
-51
View File
@@ -1,51 +0,0 @@
name: "Pinned Build"
on:
workflow_dispatch:
permissions:
packages: read
contents: read
defaults:
run:
shell: bash
jobs:
Build:
name: Build
strategy:
fail-fast: false
matrix:
platform: [ubuntu20, ubuntu22]
runs-on: ["self-hosted", "enf-x86-beefy-long"]
container: ${{ matrix.platform == 'ubuntu20' && 'ubuntu:focal' || 'ubuntu:jammy' }}
steps:
- name: Update and Install git
run: |
apt-get update
apt-get install -y git
git --version
- name: Clone leap
uses: actions/checkout@v3
with:
submodules: recursive
- name: Install dependencies
run: |
# https://github.com/actions/runner/issues/2033
chown -R $(id -u):$(id -g) $PWD
./scripts/install_deps.sh
- name: Build Pinned Build
env:
LEAP_PINNED_INSTALL_PREFIX: /usr
run: |
./scripts/pinned_build.sh deps build "$(nproc)"
- name: Upload package
uses: actions/upload-artifact@v3
with:
name: leap-${{matrix.platform}}-pinned-amd64
path: build/leap_*.deb
- name: Run Parallel Tests
run: |
cd build
ctest --output-on-failure -j $(nproc) -LE "(nonparallelizable_tests|long_running_tests)" --timeout 420
README.md
+6 -15
View File
@@ -93,7 +93,7 @@ git submodule update --init --recursive
Select build instructions below for a [pinned build](#pinned-build) (preferred) or an [unpinned build](#unpinned-build).
> ℹ️ **Pinned vs. Unpinned Build** ℹ️
We have two types of builds for Leap: "pinned" and "unpinned." The only difference is that pinned builds use specific versions for some dependencies hand-picked by the Leap engineers - they are "pinned" to those versions. In contrast, unpinned builds use the default dependency versions available on the build system at the time. We recommend performing a "pinned" build to ensure the compiler remains the same between builds of different Leap versions. Leap requires these versions to remain the same, otherwise its state might need to be recovered from a portable snapshot or the chain needs to be replayed.
We have two types of builds for Leap: "pinned" and "unpinned." A pinned build is a reproducible build with the build environment and dependency versions fixed by the development team. In contrast, unpinned builds use the dependency versions provided by the build platform. Unpinned builds tend to be quicker because the pinned build environment must be built from scratch. Pinned builds, in addition to being reproducible, ensure the compiler remains the same between builds of different Leap major versions. Leap requires the compiler version to remain the same, otherwise its state might need to be recovered from a portable snapshot or the chain needs to be replayed.
> ⚠️ **A Warning On Parallel Compilation Jobs (`-j` flag)** ⚠️
When building C/C++ software, often the build is performed in parallel via a command such as `make -j "$(nproc)"` which uses all available CPU threads. However, be aware that some compilation units (`*.cpp` files) in Leap will consume nearly 4GB of memory. Failures due to memory exhaustion will typically, but not always, manifest as compiler crashes. Using all available CPU threads may also prevent you from doing other things on your computer during compilation. For these reasons, consider reducing this value.
@@ -101,24 +101,15 @@ When building C/C++ software, often the build is performed in parallel via a com
> 🐋 **Docker and `sudo`** 🐋
If you are in an Ubuntu docker container, omit `sudo` from all commands because you run as `root` by default. Most other docker containers also exclude `sudo`, especially Debian-family containers. If your shell prompt is a hash tag (`#`), omit `sudo`.
#### Pinned Build
Make sure you are in the root of the `leap` repo, then run the `install_depts.sh` script to install dependencies:
#### Pinned Reproducible Build
The pinned reproducible build requires Docker. Make sure you are in the root of the `leap` repo and then run
```bash
sudo scripts/install_deps.sh
DOCKER_BUILDKIT=1 docker build -f tools/Dockerfile.reproducible -o . .
```
Next, run the pinned build script. You have to give it three arguments in the following order:
1. A temporary folder, for all dependencies that need to be built from source.
1. A build folder, where the binaries you need to install will be built to.
1. The number of jobs or CPU cores/threads to use (note the [jobs flag](#step-3---build) warning above).
> 🔒 You do not need to run this script with `sudo` or as root.
For example, the following command runs the `pinned_build.sh` script, specifies a `deps` and `build` folder in the root of the Leap repo for the first two arguments, then builds the packages using all of your computer's CPU threads:
This command will take a substantial amount of time because a toolchain is built from scratch. Upon completion, the current directory will contain a built `.deb` and `.tar.gz` (you can change the `-o .` argument to place the output in a different directory). If needing to reduce the number of parallel jobs as warned above, run the command as,
```bash
scripts/pinned_build.sh deps build "$(nproc)"
DOCKER_BUILDKIT=1 docker build --build-arg LEAP_BUILD_JOBS=4 -f tools/Dockerfile.reproducible -o . .
```
Now you can optionally [test](#step-4---test) your build, or [install](#step-5---install) the `*.deb` binary packages, which will be in the root of your build directory.
#### Unpinned Build
The following instructions are valid for this branch. Other release branches may have different requirements, so ensure you follow the directions in the branch or release you intend to build. If you are in an Ubuntu docker container, omit `sudo` because you run as `root` by default.
scripts/install_deps.sh
-26
View File
@@ -1,26 +0,0 @@
#!/bin/bash
apt-get update
apt-get update --fix-missing
export DEBIAN_FRONTEND='noninteractive'
export TZ='Etc/UTC'
apt-get install -y \
build-essential \
bzip2 \
cmake \
curl \
file \
git \
libbz2-dev \
libcurl4-openssl-dev \
libgmp-dev \
libncurses5 \
libtinfo-dev \
libzstd-dev \
python3 \
python3-numpy \
time \
tzdata \
unzip \
wget \
zip \
zlib1g-dev
scripts/pinned_build.sh
-166
View File
@@ -1,166 +0,0 @@
#!/bin/bash
set -eo pipefail
echo "Leap Pinned Build"
if [[ "$(uname)" == "Linux" ]]; then
if [[ -e /etc/os-release ]]; then
# obtain NAME and other information
. /etc/os-release
if [[ "${NAME}" != "Ubuntu" ]]; then
echo "Currently only supporting Ubuntu based builds. Proceed at your own risk."
fi
else
echo "Currently only supporting Ubuntu based builds. /etc/os-release not found. Your Linux distribution is not supported. Proceed at your own risk."
fi
else
echo "Currently only supporting Ubuntu based builds. Your architecture is not supported. Proceed at your own risk."
fi
if [ $# -eq 0 ] || [ -z "$1" ]; then
echo "Please supply a directory for the build dependencies to be placed and a directory for leap build and a value for the number of jobs to use for building."
echo "The binary packages will be created and placed into the leap build directory."
echo "./pinned_build.sh <dependencies directory> <leap build directory> <1-100>"
exit 255
fi
export CORE_SYM='EOS'
# CMAKE_C_COMPILER requires absolute path
DEP_DIR="$(realpath "$1")"
LEAP_DIR="$2"
JOBS="$3"
CLANG_VER=11.0.1
LLVM_VER=11.0.1
SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]:-$0}"; )" &> /dev/null && pwd 2> /dev/null; )";
START_DIR="$(pwd)"
pushdir() {
DIR="$1"
mkdir -p "${DIR}"
pushd "${DIR}" &> /dev/null
}
popdir() {
EXPECTED="$1"
D="$(popd)"
popd &> /dev/null
echo "${D}"
D="$(eval echo "$D" | head -n1 | cut -d " " -f1)"
# -ef compares absolute paths
if ! [[ "${D}" -ef "${EXPECTED}" ]]; then
echo "Directory is not where expected EXPECTED=${EXPECTED} at ${D}"
exit 1
fi
}
try(){
"$@"
res=$?
if [[ ${res} -ne 0 ]]; then
exit 255
fi
}
install_clang() {
CLANG_DIR="$1"
if [ ! -d "${CLANG_DIR}" ]; then
echo "Installing Clang ${CLANG_VER} @ ${CLANG_DIR}"
mkdir -p "${CLANG_DIR}"
CLANG_FN="clang+llvm-${CLANG_VER}-x86_64-linux-gnu-ubuntu-16.04.tar.xz"
try wget -O "${CLANG_FN}" "https://github.com/llvm/llvm-project/releases/download/llvmorg-${CLANG_VER}/${CLANG_FN}"
try tar -xvf "${CLANG_FN}" -C "${CLANG_DIR}"
pushdir "${CLANG_DIR}"
mv clang+*/* .
popdir "${DEP_DIR}"
rm "${CLANG_FN}"
fi
export PATH="${CLANG_DIR}/bin:$PATH"
export CLANG_DIR="${CLANG_DIR}"
}
install_llvm() {
LLVM_DIR="$1"
if [ ! -d "${LLVM_DIR}" ]; then
echo "Installing LLVM ${LLVM_VER} @ ${LLVM_DIR}"
mkdir -p "${LLVM_DIR}"
try wget -O "llvm-${LLVM_VER}.src.tar.xz" "https://github.com/llvm/llvm-project/releases/download/llvmorg-${LLVM_VER}/llvm-${LLVM_VER}.src.tar.xz"
try tar -xvf "llvm-${LLVM_VER}.src.tar.xz"
pushdir "${LLVM_DIR}.src"
pushdir build
try cmake -DCMAKE_TOOLCHAIN_FILE="${SCRIPT_DIR}/pinned_toolchain.cmake" -DCMAKE_INSTALL_PREFIX="${LLVM_DIR}" -DCMAKE_BUILD_TYPE=Release -DLLVM_TARGETS_TO_BUILD=host -DLLVM_BUILD_TOOLS=Off -DLLVM_ENABLE_RTTI=On -DLLVM_ENABLE_TERMINFO=Off -DCMAKE_EXE_LINKER_FLAGS=-pthread -DCMAKE_SHARED_LINKER_FLAGS=-pthread -DLLVM_ENABLE_PIC=NO ..
try make -j "${JOBS}"
try make -j "${JOBS}" install
popdir "${LLVM_DIR}.src"
popdir "${DEP_DIR}"
rm -rf "${LLVM_DIR}.src"
rm "llvm-${LLVM_VER}.src.tar.xz"
fi
export LLVM_DIR="${LLVM_DIR}"
}
pushdir "${DEP_DIR}"
install_clang "${DEP_DIR}/clang-${CLANG_VER}"
install_llvm "${DEP_DIR}/llvm-${LLVM_VER}"
# go back to the directory where the script starts
popdir "${START_DIR}"
pushdir "${LEAP_DIR}"
# build Leap
echo "Building Leap ${SCRIPT_DIR}"
try cmake -DCMAKE_TOOLCHAIN_FILE="${SCRIPT_DIR}/pinned_toolchain.cmake" -DCMAKE_INSTALL_PREFIX=${LEAP_PINNED_INSTALL_PREFIX:-/usr/local} -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH="${LLVM_DIR}/lib/cmake" "${SCRIPT_DIR}/.."
try make -j "${JOBS}"
try cpack
# art generated with DALL-E (https://openai.com/blog/dall-e), then fed through ASCIIart.club (https://asciiart.club) with permission
cat <<'TXT' # BASH interpolation must remain disabled for the ASCII art to print correctly
,▄▄A`
_╓▄██`
╓▄▓▓▀▀`
╓▓█▀╓▄▓
▓▌▓▓▓▀
,▄▓███▓H
_╨╫▀╚▀╠▌`╙¥,
╓« _╟▄▄ `½, ╓▄▄╦▄≥_
╙▓╫╬▒R▀▀╙▀▀▓φ_ «_╙Y╥▄mmMM#╦▄,_ ,╓╦mM╩╨╙╙╙\`║═
`` `▀▄__╫▓▓╨` _```"""*ⁿⁿ^`````Ω, `╟∩
╙▌▓▓"` ,«ñ` ╔╬▓▌⌂ ╔▌
╙█▌,,╔╗M╨,░ ` "╫▓m_ ╟H _
_,,,,__,╠█▓▒` .╣▌µ _ _.╓╔▄▄▓█▓▓N_ ╙▀╩KKM╙╟▓N
,▄▓█▓████▀▀▀╙▀╓╔φ»█▓▓Ñ╦«, :»»µ╦▓▓█▀└╙▀███▓╥__ _,╓▄▓▓▓M▓`,
__╓Φ▓█╫▓▓▓▓▓▓▓▓▓▓▓▓▓▀K▀▀███▓▓▓▓▓▓▀▀╙ `▀▀▀▓▄▄K╨╙└ `▀▌╙█▄*.
,╓Φ▓▓▀▄▓▀` ╙▀╙ ╙▓╙╙▓▄*
.▄▓╫▀╦▄▀` ╙▓╙µ╙▀
▄▓▀╨▓▓╨_ `▀▄▄M
_█▌▄▌╙` `╙
╙└`
Ñ▓▓▓▓ ¢▄▄▄▄▄▄▄▄▄▄ , ,,,,,,,,,,,_
_╫▓▓█▌ ╟▓████████▀ ╓╣▓▌_ ╠╫▓█▓▓▓▓█▓▓▓▓▄
_▓▓▓█▌ ╟╫██▄,,,,_ æ▄███▓▄ ▐║████▀╨╨▀▓███▌
:╫▓▓█▌ ╟╢████████▓ ,╬███████▓, ▐║████▓▄▄▓▓███▀
:╫▓▓█▌_ _╟║███▀▀▀▀▀▀ ╓╫███╣╫╬███▓N_ j▐██▀▀▀▀▀▀▀▀▀`
___________]╫▓▓█▓φ╓╓╓╓╓╓,__╟╣█▌▌,,,,,_ _╬▓████████████▓▄_ ▐M█▌
_ _________]╫▌▓█████████▓▓▄╟╣████████▓▄╣██▓▀^ _ ╙▓██▓▓╗__M█▓
___ _ _ ▀╣▀╣╩╩╩╩╩╩╩▀▀▀▀╙▀▀▀▀▀▀▀▀▀▀▀▀▀▀` ╙▀▀▀▀╩═╩▀▀
_ __ __ _____ ___ ____ _ __ _ ____ ___
____ ____ __ _ _ _ _ _ _ __ _ __ __
__ _ ________ ___ ________ ___ _ _ _ _
_ __ __ _ __ ____ _ _ ____ _ _ _ _
_ _ _ ____ ____ _ _ _ __ _ _ _ __
---
Leap has successfully built and constructed its packages. You should be able to
find the packages at:
TXT
echo "${LEAP_DIR}"
echo
echo 'Thank you, fam!!'
echo
scripts/pinned_toolchain.cmake
-19
View File
@@ -1,19 +0,0 @@
set(CLANG_DIR $ENV{CLANG_DIR})
set(CMAKE_C_COMPILER_WORKS 1)
set(CMAKE_CXX_COMPILER_WORKS 1)
set(CMAKE_C_COMPILER ${CLANG_DIR}/bin/clang)
set(CMAKE_CXX_COMPILER ${CLANG_DIR}/bin/clang++)
set(CMAKE_CXX_STANDARD_INCLUDE_DIRECTORIES ${CLANG_DIR}/include/c++/v1 /usr/local/include /usr/include)
set(CMAKE_C_FLAGS_INIT "-D_FORTIFY_SOURCE=2 -fstack-protector-strong -fpie")
set(CMAKE_CXX_FLAGS_INIT "-nostdinc++ -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fpie")
set(CMAKE_EXE_LINKER_FLAGS_INIT "-stdlib=libc++ -nostdlib++ -pie")
if(NOT APPLE)
string(APPEND CMAKE_EXE_LINKER_FLAGS_INIT " -Wl,-z,relro,-z,now")
endif()
set(CMAKE_SHARED_LINKER_FLAGS_INIT "-stdlib=libc++ -nostdlib++")
set(CMAKE_MODULE_LINKER_FLAGS_INIT "-stdlib=libc++ -nostdlib++")
set(CMAKE_CXX_STANDARD_LIBRARIES "${CLANG_DIR}/lib/libc++.a ${CLANG_DIR}/lib/libc++abi.a")
tools/Dockerfile.reproducible
+105
View File
@@ -0,0 +1,105 @@
# syntax=docker/dockerfile:1
# debian:buster on Sep 20 2023
FROM debian@sha256:d774a984460a74973e6ce4d1f87ab90f2818e41fcdd4802bcbdc4e0b67f9dadf AS builder
# If enabling the snapshot repo below, this ought to be after the base image time from above.
# date -u -d @1695620708 = Mon Sep 25 05:45:08 AM UTC 2023
ENV SOURCE_DATE_EPOCH=1695620708
# The snapshot repo is currently disabled due to poor performance. Re-eval in the future.
# When the package repo is signed, a message in the payload indicates the time when the repo becomes stale. This protection
# nominally exists to ensure older versions of the package repo which may contain defective packages aren't served in the far
# future. But in our case, we want this pinned package repo at any future date. So [check-valid-until=no] to disable this check.
##RUN <<EOF
##cat <<EOS > /etc/apt/sources.list
##deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/$(date -d @${SOURCE_DATE_EPOCH} +%Y%m%dT%H%M%SZ)/ buster main
##deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/$(date -d @${SOURCE_DATE_EPOCH} +%Y%m%dT%H%M%SZ)/ buster/updates main
##EOS
##EOF
RUN apt-get update && apt-get -y upgrade && DEBIAN_FRONTEND=noninteractive apt-get -y install build-essential \
file \
git \
libcurl4-openssl-dev \
libgmp-dev \
ninja-build \
python3 \
zlib1g-dev \
;
ARG _LEAP_CLANG_VERSION=17.0.1
ARG _LEAP_LLVM_VERSION=11.1.0
ARG _LEAP_CMAKE_VERSION=3.27.6
ADD https://github.com/llvm/llvm-project/releases/download/llvmorg-${_LEAP_CLANG_VERSION}/llvm-project-${_LEAP_CLANG_VERSION}.src.tar.xz \
https://github.com/llvm/llvm-project/releases/download/llvmorg-${_LEAP_CLANG_VERSION}/llvm-project-${_LEAP_CLANG_VERSION}.src.tar.xz.sig \
https://github.com/llvm/llvm-project/releases/download/llvmorg-${_LEAP_LLVM_VERSION}/llvm-project-${_LEAP_LLVM_VERSION}.src.tar.xz \
https://github.com/llvm/llvm-project/releases/download/llvmorg-${_LEAP_LLVM_VERSION}/llvm-project-${_LEAP_LLVM_VERSION}.src.tar.xz.sig \
https://github.com/Kitware/CMake/releases/download/v${_LEAP_CMAKE_VERSION}/cmake-${_LEAP_CMAKE_VERSION}.tar.gz \
https://github.com/Kitware/CMake/releases/download/v${_LEAP_CMAKE_VERSION}/cmake-${_LEAP_CMAKE_VERSION}-SHA-256.txt \
https://github.com/Kitware/CMake/releases/download/v${_LEAP_CMAKE_VERSION}/cmake-${_LEAP_CMAKE_VERSION}-SHA-256.txt.asc \
/
# CBA23971357C2E6590D9EFD3EC8FEF3A7BFB4EDA - Brad King <brad.king@kitware.com> (cmake)
# 474E22316ABF4785A88C6E8EA2C794A986419D8A - Tom Stellard <tstellar@redhat.com> (llvm)
# D574BD5D1D0E98895E3BF90044F2485E45D59042 - Tobias Hieta <tobias@hieta.se> (llvm)
RUN gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys CBA23971357C2E6590D9EFD3EC8FEF3A7BFB4EDA \
474E22316ABF4785A88C6E8EA2C794A986419D8A \
D574BD5D1D0E98895E3BF90044F2485E45D59042
RUN ls *.sig *.asc | xargs -n 1 gpg --verify && \
sha256sum -c --ignore-missing cmake-*-SHA-256.txt
RUN tar xf cmake-*.tar.gz && \
cd cmake*[0-9] && \
echo 'set(CMAKE_USE_OPENSSL OFF CACHE BOOL "" FORCE)' > leap-init.cmake && \
./bootstrap --parallel=$(nproc) --init=leap-init.cmake --generator=Ninja && \
ninja install
RUN tar xf llvm-project-${_LEAP_CLANG_VERSION}.src.tar.xz && \
cmake -S llvm-project-${_LEAP_CLANG_VERSION}.src/llvm -B build-toolchain -GNinja -DLLVM_INCLUDE_DOCS=Off -DLLVM_TARGETS_TO_BUILD=host -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=/pinnedtoolchain \
-DCOMPILER_RT_BUILD_SANITIZERS=Off \
-DLLVM_ENABLE_PROJECTS='lld;clang;clang-tools-extra' \
-DLLVM_ENABLE_RUNTIMES='compiler-rt;libc;libcxx;libcxxabi;libunwind' && \
cmake --build build-toolchain -t install
COPY <<-"EOF" /pinnedtoolchain/pinnedtoolchain.cmake
set(CMAKE_C_COMPILER ${CMAKE_CURRENT_LIST_DIR}/bin/clang)
set(CMAKE_CXX_COMPILER ${CMAKE_CURRENT_LIST_DIR}/bin/clang++)
set(CMAKE_CXX_STANDARD_INCLUDE_DIRECTORIES ${CMAKE_CURRENT_LIST_DIR}/include/c++/v1 ${CMAKE_CURRENT_LIST_DIR}/include/x86_64-unknown-linux-gnu/c++/v1 /usr/local/include /usr/include)
set(CMAKE_C_FLAGS_INIT "-D_FORTIFY_SOURCE=2 -fstack-protector-strong -fpie -pthread")
set(CMAKE_CXX_FLAGS_INIT "-nostdinc++ -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fpie -pthread")
set(CMAKE_EXE_LINKER_FLAGS_INIT "-stdlib=libc++ -nostdlib++ -pie -pthread -Wl,-z,relro,-z,now")
set(CMAKE_SHARED_LINKER_FLAGS_INIT "-stdlib=libc++ -nostdlib++")
set(CMAKE_MODULE_LINKER_FLAGS_INIT "-stdlib=libc++ -nostdlib++")
set(CMAKE_CXX_STANDARD_LIBRARIES "${CMAKE_CURRENT_LIST_DIR}/lib/x86_64-unknown-linux-gnu/libc++.a ${CMAKE_CURRENT_LIST_DIR}/lib/x86_64-unknown-linux-gnu/libc++abi.a")
set(CMAKE_SYSTEM_PREFIX_PATH "${CMAKE_CURRENT_LIST_DIR}/pinllvm")
EOF
ENV CMAKE_TOOLCHAIN_FILE=/pinnedtoolchain/pinnedtoolchain.cmake
RUN tar xf llvm-project-${_LEAP_LLVM_VERSION}.src.tar.xz && \
cmake -S llvm-project-${_LEAP_LLVM_VERSION}.src/llvm -B build-pinllvm -GNinja -DCMAKE_BUILD_TYPE=Release -DLLVM_TARGETS_TO_BUILD=host -DLLVM_BUILD_TOOLS=Off \
-DLLVM_ENABLE_RTTI=On -DLLVM_ENABLE_TERMINFO=Off -DLLVM_ENABLE_PIC=Off \
-DCMAKE_INSTALL_PREFIX=/pinnedtoolchain/pinllvm && \
cmake --build build-pinllvm -t install
RUN rm -rf llvm* build* cmake*
FROM builder AS build
ARG LEAP_BUILD_JOBS
COPY / /src
RUN cmake -S src -B build -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_BUILD_TYPE=Release -GNinja && \
cmake --build build -t package -- ${LEAP_BUILD_JOBS:+-j$LEAP_BUILD_JOBS} && \
src/tools/tweak-deb.sh build/leap_*.deb
FROM scratch AS exporter
COPY --from=build /build/*.deb /build/*.tar.* /
tools/tweak-deb.sh
Executable
+37
View File
@@ -0,0 +1,37 @@
#!/bin/bash
set -euo pipefail
# Tweaks a couple aspects of the built .deb's control file:
# 1. Removes Installed-Size field; this isn't reproducible for some reason, possibly different filesystems
# reporting different sizes for directories?
# 2. Removes all but the first libc Depends rule as the rest are unnecessarily restrictive. The original was being
# generated as,
# libc6 (>= 2.27), libc6 (>> 2.28), libc6 (<< 2.29), libcurl4 (>= 7.16.2), libgcc1 (>= 1:3.3), libgmp10, zlib1g (>= 1:1.2.0)
# and the included sed rule within this script will reduce it to
# libc6 (>= 2.27), libcurl4 (>= 7.16.2), libgcc1 (>= 1:3.3), libgmp10, zlib1g (>= 1:1.2.0)
# This may need to be tweaked in the future further; clearly not ideal.
WORKDIR="$(mktemp -d)"
trap 'rm -rf -- "${WORKDIR}"' EXIT
if [ $# -lt 1 ]; then
echo "Must specify .deb file to tweak as argument to script"
exit 1
fi
if [ ! -f "$1" ]; then
echo "Argument passed is not a file"
exit 1
fi
DEB_PATH="$(realpath ${1})"
cd "${WORKDIR}"
ar x "${DEB_PATH}" control.tar.gz
gzip -d control.tar.gz
tar xf control.tar ./control
tar --delete -f control.tar ./control
sed -i -E -e '/Installed-Size/d' -e 's/, libc6[^,]+//g' control
tar --update --mtime "@0" --owner=0 --group=0 --numeric-owner -f control.tar ./control
gzip -n control.tar
ar rD "${DEB_PATH}" control.tar.gz