[PATCH 1/2] libseccomp: Fix reproducibility issue

[PATCH 1/2] libseccomp: Fix reproducibility issue

[Richard Purdie]

Rather than installing libtool wrapper scripts which won't work on target
and aren't reproducible, use the real binaries.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 meta/recipes-support/libseccomp/libseccomp_2.5.1.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-support/libseccomp/libseccomp_2.5.1.bb b/meta/recipes-support/libseccomp/libseccomp_2.5.1.bb
index 98b2639742b..8fe1023901c 100644
--- a/meta/recipes-support/libseccomp/libseccomp_2.5.1.bb
+++ b/meta/recipes-support/libseccomp/libseccomp_2.5.1.bb
@@ -42,6 +42,10 @@ do_install_ptest() {
     for file in $(find tools/* -executable -type f); do
         install -m 744 ${S}/${file} ${D}/${PTEST_PATH}/tools
     done
+    # Overwrite libtool wrappers with real executables
+    for file in $(find tools/.libs/* -executable -type f); do
+        install -m 744 ${S}/${file} ${D}/${PTEST_PATH}/tools
+    done
 }
 
 FILES_${PN} = "${bindir} ${libdir}/${BPN}.so*"
-- 
2.30.2

[PATCH 2/2] apt: Disable libseccomp

[Richard Purdie]

This isn't in DEPENDS and isn't configured. It can detect the library when
pulled in via other dependencies meaning the build isn't deterministic.

Ultimately this could become a PACKAGECONFIG. It doesn't build on musl
so disable it for now until someone fixes and sorts this out properly.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 meta/recipes-devtools/apt/apt_2.2.2.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-devtools/apt/apt_2.2.2.bb b/meta/recipes-devtools/apt/apt_2.2.2.bb
index 7d1bce558d1..326f691ec03 100644
--- a/meta/recipes-devtools/apt/apt_2.2.2.bb
+++ b/meta/recipes-devtools/apt/apt_2.2.2.bb
@@ -45,6 +45,7 @@ EXTRA_OECMAKE_append = " -DCURRENT_VENDOR=debian -DWITH_DOC=False \
     -DDPKG_DATADIR=${datadir}/dpkg \
     -DTRIEHASH_EXECUTABLE=${WORKDIR}/triehash \
     -DCMAKE_DISABLE_FIND_PACKAGE_ZSTD=True \
+    -DCMAKE_DISABLE_FIND_PACKAGE_SECCOMP=True \
     -DWITH_TESTS=False \
 "
 
-- 
2.30.2

Re: [OE-core] [PATCH 2/2] apt: Disable libseccomp

[Khem Raj]

[-- Attachment #1: Type: text/plain, Size: 1318 bytes --]

On Sun, Apr 25, 2021 at 9:59 AM Richard Purdie <
richard.purdie@linuxfoundation.org> wrote:

> This isn't in DEPENDS and isn't configured. It can detect the library when
> pulled in via other dependencies meaning the build isn't deterministic.
>
> Ultimately this could become a PACKAGECONFIG. It doesn't build on musl
> so disable it for now until someone fixes and sorts this out properly


I think it will be better to check for seccomp distro feature to set this
option that will make it deterministic and for musl I have sent a fix
already


> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> ---
>  meta/recipes-devtools/apt/apt_2.2.2.bb | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/meta/recipes-devtools/apt/apt_2.2.2.bb
> b/meta/recipes-devtools/apt/apt_2.2.2.bb
> index 7d1bce558d1..326f691ec03 100644
> --- a/meta/recipes-devtools/apt/apt_2.2.2.bb
> +++ b/meta/recipes-devtools/apt/apt_2.2.2.bb
> @@ -45,6 +45,7 @@ EXTRA_OECMAKE_append = " -DCURRENT_VENDOR=debian
> -DWITH_DOC=False \
>      -DDPKG_DATADIR=${datadir}/dpkg \
>      -DTRIEHASH_EXECUTABLE=${WORKDIR}/triehash \
>      -DCMAKE_DISABLE_FIND_PACKAGE_ZSTD=True \
> +    -DCMAKE_DISABLE_FIND_PACKAGE_SECCOMP=True \
>      -DWITH_TESTS=False \
>  "
>
> --
> 2.30.2
>
>
> 
>
>

[-- Attachment #2: Type: text/html, Size: 2307 bytes --]