download/git: create GNU format tar files
PATCH 1/1 download/git: create GNU format tar files
On most distros, the tar format defaults to GNU. However, at build time the default format may be changed to posix. Also, future versions of tar will default to posix.
Since we want the tarballs created by the git download method to be reproducible (so their hash can be checked), we should explicitly specify the format. Since existing tarballs on sources.buildroot.org use the GNU format, and also the existing hashes in the *.hash files are based on GNU format tarballs, we use the GNU format.
In addition, the Posix format encodes atime and ctime as well as mtime, but tar offers no option like --mtime to override them. In the GNU format, atime and ctime are only encoded if the --incremental option is given.
---
Peter, can you test if this solves the issue for you?
--- support/download/git | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
support/download/git +3 -1
@@ -94,6 +94,8 @@ popd >/dev/null # Generate the archive, sort with the C locale so that it is reproducible find "${basename}" -not -type d >"${basename}.list" LC_ALL=C sort <"${basename}.list" >"${basename}.list.sorted" -tar cf - --numeric-owner --owner=0 --group=0 --mtime="${date}" \ +# Create GNU-format tarballs, since that's the format of the tarballs on +# sources.buildroot.org and used in the *.hash files +tar cf - --numeric-owner --owner=0 --group=0 --mtime="${date}" --format=gnu \ -T "${basename}.list.sorted" >"${output}.tar" gzip -n <"${output}.tar" >"${output}"
Signature · 1 line
2.11.0
PATCH 1/1 download/git: create GNU format tar files
Hello Arnout,
Quoted 15 lines · Arnout Vandecappelle (Essensium/Mind)
On most distros, the tar format defaults to GNU. However, at build time the default format may be changed to posix. Also, future versions of tar will default to posix.
Since we want the tarballs created by the git download method to be reproducible (so their hash can be checked), we should explicitly specify the format. Since existing tarballs on sources.buildroot.org use the GNU format, and also the existing hashes in the *.hash files are based on GNU format tarballs, we use the GNU format.
In addition, the Posix format encodes atime and ctime as well as mtime, but tar offers no option like --mtime to override them. In the GNU format, atime and ctime are only encoded if the --incremental option is given.
Quoted 4 lines
Cc Peter Seiderer <[email protected]>---
Peter, can you test if this solves the issue for you?
After removing the old dl/wiringpi-2.44.tar.gz file, applying your patch and done a fresh download:
$ cat package/wiringpi/wiringpi.hash # Locally calculated sha256 464c98ed54f5c0ad6611e270be3491c4598a32b7e86b208255862a301c564955 wiringpi-2.44.tar.gz
$ sha256sum dl/wiringpi-2.44.tar.gz 464c98ed54f5c0ad6611e270be3491c4598a32b7e86b208255862a301c564955 dl/wiringpi-2.44.tar.gz
Regards,
Peter
Quoted 18 lines
--- support/download/git | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)support/download/git +3
-1@@ -94,6 +94,8 @@ popd >/dev/null # Generate the archive, sort with the C locale so that it is reproducible find "${basename}" -not -type d >"${basename}.list" LC_ALL=C sort <"${basename}.list" >"${basename}.list.sorted" -tar cf - --numeric-owner --owner=0 --group=0 --mtime="${date}" \ +# Create GNU-format tarballs, since that's the format of the tarballs on +# sources.buildroot.org and used in the *.hash files +tar cf - --numeric-owner --owner=0 --group=0 --mtime="${date}" --format=gnu \ -T "${basename}.list.sorted" >"${output}.tar" gzip -n <"${output}.tar" >"${output}"