1

I would like my initramfs to have the same hash no matter when or where I build it if the contents of the files are the same (and are owned by root and have same permissions). I don't see any options in GNU cpio to strip or set timestamps of files in the archive. Is there a relatively standard way to massage the input to cpio and other archive programs so you can get reproducible products?

Going along with this, is there a conventional "We aren't giving this a date" timestamp? Something most software won't wig out about? For example 0 epoch-seconds?

For example, if I did a find pass on an input directory for an initramfs and manually set all the timestamps to 0, could I build that archive, extract it on another system, repeat the process, and build it again and get bit-identical files?

davolfman
  • 479
  • 2
  • 7

2 Answers2

6

Newer versions of GNU cpio have a --reproducible flag which goes some way towards your requirements. My understanding is that the strip-nondeterminism tool will handle the timestamp requirement after the fact. touch will allow you to set the time before you package of course.

schily
  • 18,806
  • 5
  • 38
  • 60
icarus
  • 17,420
  • 1
  • 37
  • 54
  • I see the rip of the man page I was reading was outdated. That's probably a lot of what I'm looking for. Does any part of a system tend to freak out if the timestamps are heavily backdated? Not used in this case, but for example, I know GPG freaks out if files are dated in the future. Does OpenSSL freak out if you try to verify a signature using an x509 with a filesystem date old enough it should have expired, say? – davolfman Nov 26 '19 at 19:38
  • @davolfman I don't know enough to answer this particular question. My guess would be that OpenSSL would not care about the times associated with the file, just the current system time. `make` is the main thing I use that worries about the times and can get upset about the future, and people use make in lots of interesting ways. – icarus Nov 26 '19 at 23:25
  • You can also set the file times beforehand so that you don't have to process the file afterwards: `find PATH | xargs -I {} touch -d @0 {}` – Compholio Oct 01 '21 at 15:30
  • @Compholio "touch will allow you to set the time before you package of course". – icarus Oct 01 '21 at 16:55
2

You can do this using star and it's builtin find based on libfind.

Call e.g.:

star -c H=cpio -find somedir -chmtime 2020-05-20T12:10:12 > archive.cpio

You may of course use complex find rules for different time stamps if you like.

Check http://sourceforge.net/projects/schilytools/files/ for a recent star source in the latest schilytools tarball.

BTW: I believe the following could look like advertizing, but the information has been requested and it is OpenSource since it's beginning. star should be well known on UNIX as it is the oldest free tar implementation - it started in 1982, which makes it 38 years old in 2020.

star is the most mature and most feature complete tar implementation I am aware of. Other implementations usually copy concepts for archive format enhancements from star, which is identified by the SCHILY.* property prefix introduced by star and used by others as well.

Since 32 years, it forks into two processes that share a configurable FIFO for maximum speed. star -copy is faster than any other known UNIX tree copy method.

Since 30 years, it supports and auto-detects various archive formats.

Since 17 years is it a generic archiver tool that implements command line compatibility to various UNIX archivers like tar, cpio pax and even the incompatible GNU tar.

Since 16 years, it includes support for the enhanced find command line syntax via libfind. This helps to avoid learning unneeded new usage concepts, since everybody should know how to use find.

Since 2 years, it completely removed path name length limitations.

See http://cdrtools.sourceforge.net/private/star.html and http://schilytools.sourceforge.net/man/man1/star.1.html for more informations.

schily
  • 18,806
  • 5
  • 38
  • 60
  • Hi Jörg, your link to your repo does not make it particularly easy to either find or understand exactly what your code (aka "star" does or does not). Can you explain in your answer what it is all about and why it does it better than whatever solution based on cpio and other native *nix/linux tools ? – Cbhihe May 25 '20 at 16:06
  • I am using `star` many times each day and no other implementation would be usable for most of my needs. Userfriendly Linux distros install it as `cpio` and `pax` because other free implementations of these programs have many problems. Linux however does no install `star` as `tar` because users seem to request the incompatibilities from GNU tar. – schily May 25 '20 at 19:02