add-determinism

Build postprocessors to reset metadata fields and hardlink files for build reproducibility

<a href="https://repology.org/project/add-determinism/versions" <img src="https://repology.org/badge/vertical-allrepos/add-determinism.svg" alt="Packaging status" align="right" </a

This crate provides two related programs for package build postprocessing.

add-det

add-det takes one or more paths as arguments, and will recursively process normal files in those paths, attempting to run a set of type-specific handlers on any files with extensions that match. (Each argument can be either a single file or a directory to be processed recursively.)

For each processed file, a temporary file is opened, the contents are rewritten, the modification timestamp is copied from the original file to the temporary copy, and the copy is renamed over the original.

If processing fails, a warning is emitted, but no modifications are made and the program returns success.

The purpose of this tool is to eliminate common sources of non-determinism in builds, making it easier to create reproducible (package) builds.

Usage

#### Standalone usage

$ add-det /path/to/file /path/to/directory

Note that the program works in-place, replacing input files with the rewritten versions (if any modifications are made).

Some useful options:

• -v — enable debug output
• -j [N] — use N workers (or as many as CPUs, if N is not given)
• --handler list|HANDLER|-HANDLER — constrain the list of handlers. Takes a comma-separated list of names, either a list of "positive" names, in which case only listed handlers will be used, or a list of "negative" names, each prefixed by minus, in which case the listed handlers will not be used. By default, handlers that cannot be initialized are skipped with a warning. If a "positive" list is given, failure to initialize a handler will cause an error. The special value list can be used to list known handlers.
• --brp — enable "build root program" mode, see below.
• -V, --version — print program version

#### In an rpm build environment

When invoked with --brp, the $RPMBUILDROOT environment variable must be defined and not empty. All arguments must be below $RPMBUILDROOT. This option is intended to be used in rpm macros that define post-install steps. See redhat-rpm-config pull request #293 for the pull request that added a call to add-det in %osinstallpost.

#### Verification instead of modification

When invoked with --check, the tool processes all files, but does not actually save any modifications. Instead, it'll fail if any files would have been modified. It also returns an error if any files cannot be read.