https://github.com/edgelesssys/reproducible-mkosi
Build bit-by-bit reproducible OS images with mkosi and Nix
https://github.com/edgelesssys/reproducible-mkosi
Last synced: 8 months ago
JSON representation
Build bit-by-bit reproducible OS images with mkosi and Nix
- Host: GitHub
- URL: https://github.com/edgelesssys/reproducible-mkosi
- Owner: edgelesssys
- License: mit
- Created: 2023-08-18T17:17:36.000Z (almost 3 years ago)
- Default Branch: main
- Last Pushed: 2024-02-07T10:20:37.000Z (over 2 years ago)
- Last Synced: 2024-02-07T11:31:41.336Z (over 2 years ago)
- Language: Shell
- Homepage:
- Size: 165 KB
- Stars: 4
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
Reproducible mkosi
Build bit-by-bit reproducible OS images
[mkosi](https://github.com/systemd/mkosi) is a tool for building customized OS images.
This repository shows how to use [Nix](https://nixos.org/) to pin mkosi and required
tools and build bit-by-bit reproducible OS images.
### Usage
1. Clone the repository
```shell-session
git clone https://github.com/edgelesssys/reproducible-mkosi
cd reproducible-mkosi
```
2. Install nix (we recommend the [determinate systems installer](https://github.com/DeterminateSystems/nix-installer))
3. Enter a shell with mkosi and package manager tools for Fedora or Ubuntu
```shell-session
nix develop .#mkosi-fedora
# or
nix develop .#mkosi-ubuntu
```
4. Perform two builds and compare the output
```shell-session
nix run .#diffimage fedora
# or
nix run .#diffimage ubuntu
```
### History of getting and keeping this reproducible
Hours of debugging went into making this fully reproducible, and there are still things left to do,
especially regarding the handling of packages pulled in by the package manger of the target distro.
In the following, we list some work we did upstream that explicitly fix reproducibility issues.
- [**systemd/mkosi** propagate SOURCE_DATE_EPOCH when calling systemd-repart](https://github.com/systemd/mkosi/pull/1834)
- [**systemd/mkosi** add config setting seed to set systemd-repart --seed](https://github.com/systemd/mkosi/pull/1837)
- [**systemd/mkosi** normalize mtime](https://github.com/systemd/mkosi/pull/1839)
- [**systemd/mkosi** make_tar: do not emit extended PAX headers for atime, ctime and mtime](https://github.com/systemd/mkosi/pull/1982)
- [**systemd/mkosi** make_cpio: sort files used as cpio input](https://github.com/systemd/mkosi/pull/2163)
- [**systemd/mkosi** "-C" flag results in inconsistent relative path handling](https://github.com/systemd/mkosi/issues/1879)
- [**systemd/systemd** repart: temporary hardlink store leaks into final image when host uses btrfs](https://github.com/systemd/systemd/issues/29606)
- [**systemd/systemd** mkfs-util: propagate SOURCE_DATE_EPOCH to mcopy](https://github.com/systemd/systemd/pull/29000)
- [**authselect/authselect** remove timestamp from generated files](https://github.com/authselect/authselect/pull/350)
- [**NixOS/nixpkgs** dosfstools: backport reproducible builds patch](https://github.com/NixOS/nixpkgs/pull/252282)
### Open tasks
- [ ] Pin and archive rpm/deb packages
- [ ] Build more parts of the CVM TCB (firmware, kernel, packages from source)