mirror of
https://github.com/openwrt/openwrt.git
synced 2026-07-20 16:11:59 +04:00
package: nftables backport of reproducible builds patches
Building `nftables` twice results in slightly different binaries and since it's including in the OpenWrt default firmware, breaks reproducibility of shipped artifacts. Enabling autoreconf, since the patches introduce a `nftvbersion.h.in` file. This commit backports patches netfilter to fix this: * https://git.netfilter.org/nftables/commit/?id=ca86f206c92704170a295b8dc7a41f6448835dde * https://git.netfilter.org/nftables/commit/?id=b92571cc59ce49fdd9fe2daac9350529adfb2424 * https://git.netfilter.org/nftables/commit/?id=2a0ec8a7246e5c5eb85270e3d4de43e20a00c577 Fixes: https://github.com/openwrt/openwrt/issues/23709 Link: https://github.com/openwrt/openwrt/pull/23735 Signed-off-by: Paul Spooren <mail@aparcar.org>
This commit is contained in:
Paul Spooren
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=nftables
|
||||
PKG_VERSION:=1.1.6
|
||||
PKG_RELEASE:=1
|
||||
PKG_RELEASE:=2
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
|
||||
PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
|
||||
@@ -18,6 +18,7 @@ PKG_LICENSE:=GPL-2.0
|
||||
PKG_LICENSE_FILES:=COPYING
|
||||
|
||||
PKG_INSTALL:=1
|
||||
PKG_FIXUP:=autoreconf
|
||||
|
||||
PKG_BUILD_FLAGS:=lto
|
||||
|
||||
|
||||
+78
@@ -0,0 +1,78 @@
|
||||
From 2a0ec8a7246e5c5eb85270e3d4de43e20a00c577 Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Sowden <jeremy@azazel.net>
|
||||
Date: Wed, 28 Jan 2026 18:31:05 +0000
|
||||
Subject: [PATCH] build: simplify the instantation of nftversion.h
|
||||
|
||||
Add an nftversion.h.in autoconf input file which configure uses to instantiate
|
||||
nftversion.h in the usual way.
|
||||
|
||||
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
---
|
||||
configure.ac | 19 +++----------------
|
||||
nftversion.h.in | 19 +++++++++++++++++++
|
||||
2 files changed, 22 insertions(+), 16 deletions(-)
|
||||
create mode 100644 nftversion.h.in
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 6825474..2c61072 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -147,22 +147,8 @@ AM_CONDITIONAL([BUILD_SERVICE], [test "x$unitdir" != x])
|
||||
AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
|
||||
[Stable release number])],
|
||||
[], [with_stable_release=0])
|
||||
-AC_CONFIG_COMMANDS([stable_release],
|
||||
- [STABLE_RELEASE=$stable_release],
|
||||
- [stable_release=$with_stable_release])
|
||||
-AC_CONFIG_COMMANDS([nftversion.h], [
|
||||
-(
|
||||
- echo "static char nftversion[[]] = {"
|
||||
- echo " ${VERSION}," | tr '.' ','
|
||||
- echo " ${STABLE_RELEASE}"
|
||||
- echo "};"
|
||||
- echo "static char nftbuildstamp[[]] = {"
|
||||
- for ((i = 56; i >= 0; i-= 8)); do
|
||||
- echo " ((uint64_t)MAKE_STAMP >> $i) & 0xff,"
|
||||
- done
|
||||
- echo "};"
|
||||
-) >nftversion.h
|
||||
-])
|
||||
+AC_SUBST([STABLE_RELEASE],[$with_stable_release])
|
||||
+AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')])
|
||||
# Current date should be fetched exactly once per build,
|
||||
# so have 'make' call date and pass the value to every 'gcc' call
|
||||
AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
|
||||
@@ -175,6 +161,7 @@ AM_CONDITIONAL([BUILD_DISTCHECK], [test "x$enable_distcheck" = "xyes"])
|
||||
AC_CONFIG_FILES([ \
|
||||
Makefile \
|
||||
libnftables.pc \
|
||||
+ nftversion.h \
|
||||
])
|
||||
AC_OUTPUT
|
||||
|
||||
diff --git a/nftversion.h.in b/nftversion.h.in
|
||||
new file mode 100644
|
||||
index 0000000..6f89771
|
||||
--- /dev/null
|
||||
+++ b/nftversion.h.in
|
||||
@@ -0,0 +1,19 @@
|
||||
+#ifndef NFTABLES_NFTVERSION_H
|
||||
+#define NFTABLES_NFTVERSION_H
|
||||
+
|
||||
+static char nftversion[] = {
|
||||
+ @NFT_VERSION@,
|
||||
+ @STABLE_RELEASE@
|
||||
+};
|
||||
+static char nftbuildstamp[] = {
|
||||
+ ((uint64_t)MAKE_STAMP >> 56) & 0xff,
|
||||
+ ((uint64_t)MAKE_STAMP >> 48) & 0xff,
|
||||
+ ((uint64_t)MAKE_STAMP >> 40) & 0xff,
|
||||
+ ((uint64_t)MAKE_STAMP >> 32) & 0xff,
|
||||
+ ((uint64_t)MAKE_STAMP >> 24) & 0xff,
|
||||
+ ((uint64_t)MAKE_STAMP >> 16) & 0xff,
|
||||
+ ((uint64_t)MAKE_STAMP >> 8) & 0xff,
|
||||
+ ((uint64_t)MAKE_STAMP >> 0) & 0xff,
|
||||
+};
|
||||
+
|
||||
+#endif /* !defined(NFTABLES_NFTVERSION_H) */
|
||||
+83
@@ -0,0 +1,83 @@
|
||||
From b92571cc59ce49fdd9fe2daac9350529adfb2424 Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Sowden <jeremy@azazel.net>
|
||||
Date: Wed, 28 Jan 2026 18:31:06 +0000
|
||||
Subject: [PATCH] build: generate build time-stamp once at configure
|
||||
|
||||
The existing implementation tries to generate a time-stamp once when make is
|
||||
run. However, it doesn't work and generates one for every compilation. Getting
|
||||
this right portably in automake is not straightforward. Instead, do it when
|
||||
configure is run.
|
||||
|
||||
Rename the time-stamp variable since it is no longer generated by make.
|
||||
|
||||
Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
|
||||
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
---
|
||||
Makefile.am | 2 --
|
||||
configure.ac | 4 +---
|
||||
nftversion.h.in | 18 ++++++++++--------
|
||||
3 files changed, 11 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/Makefile.am b/Makefile.am
|
||||
index b134330..ceb2225 100644
|
||||
--- a/Makefile.am
|
||||
+++ b/Makefile.am
|
||||
@@ -159,8 +159,6 @@ AM_CFLAGS = \
|
||||
\
|
||||
$(GCC_FVISIBILITY_HIDDEN) \
|
||||
\
|
||||
- -DMAKE_STAMP=$(MAKE_STAMP) \
|
||||
- \
|
||||
$(NULL)
|
||||
|
||||
AM_YFLAGS = -d -Wno-yacc
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 2c61072..9859072 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -149,9 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
|
||||
[], [with_stable_release=0])
|
||||
AC_SUBST([STABLE_RELEASE],[$with_stable_release])
|
||||
AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')])
|
||||
-# Current date should be fetched exactly once per build,
|
||||
-# so have 'make' call date and pass the value to every 'gcc' call
|
||||
-AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
|
||||
+AC_SUBST([BUILD_STAMP], [$(date +%s)])
|
||||
|
||||
AC_ARG_ENABLE([distcheck],
|
||||
AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
|
||||
diff --git a/nftversion.h.in b/nftversion.h.in
|
||||
index 6f89771..325b9dc 100644
|
||||
--- a/nftversion.h.in
|
||||
+++ b/nftversion.h.in
|
||||
@@ -1,19 +1,21 @@
|
||||
#ifndef NFTABLES_NFTVERSION_H
|
||||
#define NFTABLES_NFTVERSION_H
|
||||
|
||||
+#define BUILD_STAMP @BUILD_STAMP@
|
||||
+
|
||||
static char nftversion[] = {
|
||||
@NFT_VERSION@,
|
||||
@STABLE_RELEASE@
|
||||
};
|
||||
static char nftbuildstamp[] = {
|
||||
- ((uint64_t)MAKE_STAMP >> 56) & 0xff,
|
||||
- ((uint64_t)MAKE_STAMP >> 48) & 0xff,
|
||||
- ((uint64_t)MAKE_STAMP >> 40) & 0xff,
|
||||
- ((uint64_t)MAKE_STAMP >> 32) & 0xff,
|
||||
- ((uint64_t)MAKE_STAMP >> 24) & 0xff,
|
||||
- ((uint64_t)MAKE_STAMP >> 16) & 0xff,
|
||||
- ((uint64_t)MAKE_STAMP >> 8) & 0xff,
|
||||
- ((uint64_t)MAKE_STAMP >> 0) & 0xff,
|
||||
+ ((uint64_t)BUILD_STAMP >> 56) & 0xff,
|
||||
+ ((uint64_t)BUILD_STAMP >> 48) & 0xff,
|
||||
+ ((uint64_t)BUILD_STAMP >> 40) & 0xff,
|
||||
+ ((uint64_t)BUILD_STAMP >> 32) & 0xff,
|
||||
+ ((uint64_t)BUILD_STAMP >> 24) & 0xff,
|
||||
+ ((uint64_t)BUILD_STAMP >> 16) & 0xff,
|
||||
+ ((uint64_t)BUILD_STAMP >> 8) & 0xff,
|
||||
+ ((uint64_t)BUILD_STAMP >> 0) & 0xff,
|
||||
};
|
||||
|
||||
#endif /* !defined(NFTABLES_NFTVERSION_H) */
|
||||
+33
@@ -0,0 +1,33 @@
|
||||
From ca86f206c92704170a295b8dc7a41f6448835dde Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Sowden <jeremy@azazel.net>
|
||||
Date: Wed, 28 Jan 2026 18:31:07 +0000
|
||||
Subject: [PATCH] build: support `SOURCE_DATE_EPOCH` for build time-stamp
|
||||
|
||||
In order to support reproducible builds, set the build time-stamp to the value
|
||||
of the environment variable, `SOURCE_DATE_EPOCH`, if set, and fall back to
|
||||
calling `date`, otherwise.
|
||||
|
||||
Link: https://reproducible-builds.org/docs/source-date-epoch/
|
||||
Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
|
||||
Reported-by: Arnout Engelen <arnout@bzzt.net>
|
||||
Closes: https://github.com/NixOS/nixpkgs/issues/478048
|
||||
Suggested-by: Philipp Bartsch <phil@grmr.de>
|
||||
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
---
|
||||
configure.ac | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 9859072..0226086 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -149,7 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
|
||||
[], [with_stable_release=0])
|
||||
AC_SUBST([STABLE_RELEASE],[$with_stable_release])
|
||||
AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')])
|
||||
-AC_SUBST([BUILD_STAMP], [$(date +%s)])
|
||||
+AC_SUBST([BUILD_STAMP], [${SOURCE_DATE_EPOCH:-$(date +%s)}])
|
||||
|
||||
AC_ARG_ENABLE([distcheck],
|
||||
AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
|
||||
Reference in New Issue
Block a user