Reproducible builds by roxell · Pull Request #300 · kernelci/tuxmake

roxell · 2026-08-06T13:39:10Z

Two builds of the same tree did not give the same artifacts. The build
dir and the source tree ended up in the debug info, the modules tarball
had a symlink to the build dir, and a build from a git worktree lost the
git part of the kernel version.

Two arm64 defconfig builds now give the same seven artifacts, vmlinux
byte for byte.

The compat vDSO needs a kernel patch too. Will send separately.

We set -ffile-prefix-map=<build dir>/= to hide the build path. The trailing slash misses the compilation directory, which is the build dir itself, so DW_AT_comp_dir keeps the full path. Two builds in different build dirs are then not bit by bit identical. Drop the slash and map the build dir to /tuxmake. Set the same in KAFLAGS for the .S files, and keep both out of the reproducer. Signed-off-by: Anders Roxell <anders.roxell@linaro.org>

modules_install creates lib/modules/<ver>/build and source. They point at the local build and source dirs. The build dir is new for every build, so the tarball is never the same twice, even when the modules are identical. The links are broken outside the build machine anyway. Leave them out. Signed-off-by: Anders Roxell <anders.roxell@linaro.org>

We map the build dir, but not the source tree. Kbuild passes the source files with an absolute path, so DW_AT_name keeps it. Two builds of the same tree in different dirs are then not bit by bit identical. Map the source tree too, with a trailing slash, so the file names come out relative to the tree, like an in tree build. It comes first: the last map that matches wins, and --build-dir can put the build dir inside the source tree. Rust needs its own, rustc does not take the gcc spelling. It also needs the scope, the kernel sets --remap-path-scope=macro for out of tree builds and rustc takes that once only. That needs a kernel patch, sent separately. Signed-off-by: Anders Roxell <anders.roxell@linaro.org>

In a git worktree .git is a file that points at a dir outside the tree. We only mount the source tree, so git does not work in the container. setlocalversion finds nothing, and the kernel version loses the git part. A worktree build gets 7.2.0-rc5 where the main tree gets 7.2.0-rc5-00001-gd000866da13d, and that string ends up in the kernel. Mount the git dir read only, setlocalversion does not write. The gitdir is not always absolute. worktree.useRelativePaths and submodules write it relative to the tree, so resolve it there. Against the current dir it gives a path that does not exist, and docker mounts that as an empty dir without saying anything. Signed-off-by: Anders Roxell <anders.roxell@linaro.org>

TuxMake puts prefix maps in KCFLAGS, KAFLAGS and KRUSTFLAGS. They keep paths out of the debug info. But --environment can set the same variables, and then the user value replaces our maps and the reproducer carries that on to the next machine. Put the maps in front of what the user passed. The reproducer keeps only the user part, because the maps hold paths from this machine. Reported-by: Ben Copeland <ben.copeland@linaro.org> Signed-off-by: Anders Roxell <anders.roxell@linaro.org>

roxell requested a review from bhcopeland August 6, 2026 13:43