From 8e7a8a2b9210481adbfbfe42aa37cfc804817674 Mon Sep 17 00:00:00 2001 From: John Crispin Date: Mon, 21 Sep 2026 20:45:06 +0200 Subject: [PATCH] image: create the archive images with fixed metadata Several image recipes call tar without the options that pin the member order, the owner, the mode and the modification time. The archive then holds the build time, the umask of the build user and the readdir order of the build directory, so two builds of the same source produce different images. Pass the same options that Image/mkfs/targz and sysupgrade-tar.sh already use. The recipes define no member order, so sorting the members takes nothing away. The diffoscope of the published WAX610 archive shows the order differing between the build machines, which is what a readdir order produces. --mode=go-w clears the write bit of the group and of the others. tar keeps the mode of the file on disk, which follows the umask of the build user, so without it the archive differs between a host with umask 022 and one with umask 002. Covers the Netgear factory archives of ipq40xx, ipq60xx and ipq807x, the Creality factory archive of mt76x8, the D-Link DWL8610AP archive of bcm53xx, the Freecom archive of ixp4xx and the Linksys switch archive of realtek. Signed-off-by: John Crispin --- scripts/linksys-image.sh | 7 ++++++- target/linux/bcm53xx/image/Makefile | 3 ++- target/linux/ipq40xx/image/generic.mk | 3 ++- target/linux/ixp4xx/image/Makefile | 3 ++- target/linux/qualcommax/image/ipq60xx.mk | 3 ++- target/linux/qualcommax/image/ipq807x.mk | 3 ++- target/linux/ramips/image/mt76x8.mk | 4 +++- 7 files changed, 19 insertions(+), 7 deletions(-) diff --git a/scripts/linksys-image.sh b/scripts/linksys-image.sh index d35439907ea..63fd52fad43 100755 --- a/scripts/linksys-image.sh +++ b/scripts/linksys-image.sh @@ -89,6 +89,11 @@ chmod +x $imgdir/iss_nand_imageupgrade.sh cp $1 $imgdir/series_vmlinux.bix -tar cf $2 -C $tmpdir image/ +mtime="" +if [ -n "$SOURCE_DATE_EPOCH" ]; then + mtime="--mtime=@${SOURCE_DATE_EPOCH}" +fi + +tar cf $2 -C $tmpdir --sort=name --numeric-owner --owner=0 --group=0 --mode=go-w $mtime image/ rm -rf $tmpdir diff --git a/target/linux/bcm53xx/image/Makefile b/target/linux/bcm53xx/image/Makefile index 38a2b3a8305..2f239dcbd8e 100644 --- a/target/linux/bcm53xx/image/Makefile +++ b/target/linux/bcm53xx/image/Makefile @@ -122,7 +122,8 @@ define Build/dwl8610ap-image cp $@ $@.tmptar/rootfs.bin # Hash the rootfs.bin cat $@.tmptar/rootfs.bin | md5sum > $@.tmptar/rootfs.md5 - cd $@.tmptar && tar -c -f $@.new * + cd $@.tmptar && $(TAR) -c -f $@.new --sort=name --numeric-owner --owner=0 --group=0 --mode=go-w \ + $(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") * rm -rf $@.tmptar mv $@.new $@ endef diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk index 3930d862e61..77eff37020b 100644 --- a/target/linux/ipq40xx/image/generic.mk +++ b/target/linux/ipq40xx/image/generic.mk @@ -80,7 +80,8 @@ define Build/wac5xx-netgear-tar md5sum $@.tmp/wac5xx-ubifs-root.img > $@.tmp/wac5xx-ubifs-root.md5sum echo "WAC505 WAC510" > $@.tmp/metadata.txt echo "WAC505_V9.9.9.9" > $@.tmp/version - tar -C $@.tmp/ -cf $@ . + $(TAR) -C $@.tmp/ -cf $@ --sort=name --numeric-owner --owner=0 --group=0 --mode=go-w \ + $(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") . rm -rf $@.tmp endef diff --git a/target/linux/ixp4xx/image/Makefile b/target/linux/ixp4xx/image/Makefile index 2b804765600..87f0cc891a8 100644 --- a/target/linux/ixp4xx/image/Makefile +++ b/target/linux/ixp4xx/image/Makefile @@ -16,7 +16,8 @@ define Build/freecom-image mkdir -p $@.tmptar # Add kernel cp $@ $@.tmptar/zImage - cd $@.tmptar && tar -c -j -f $@.new --numeric-owner --owner=0 --group=0 * + cd $@.tmptar && $(TAR) -c -j -f $@.new --sort=name --numeric-owner --owner=0 --group=0 --mode=go-w \ + $(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") * rm -rf $@.tmptar encode_crc $@.new $@ rm -f $@.new diff --git a/target/linux/qualcommax/image/ipq60xx.mk b/target/linux/qualcommax/image/ipq60xx.mk index 92f8413d02c..fb16ca0ace9 100644 --- a/target/linux/qualcommax/image/ipq60xx.mk +++ b/target/linux/qualcommax/image/ipq60xx.mk @@ -7,7 +7,8 @@ define Build/wax610-netgear-tar md5sum $@.tmp/nand-ipq6018-apps.img | cut -c 1-32 > $@.tmp/nand-ipq6018-apps.md5sum echo "WAX610" > $@.tmp/metadata.txt echo "WAX610-610Y_V99.9.9.9" > $@.tmp/version - tar -C $@.tmp/ -cf $@ . + $(TAR) -C $@.tmp/ -cf $@ --sort=name --numeric-owner --owner=0 --group=0 --mode=go-w \ + $(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") . rm -rf $@.tmp endef diff --git a/target/linux/qualcommax/image/ipq807x.mk b/target/linux/qualcommax/image/ipq807x.mk index 4722316727d..72c1e571039 100644 --- a/target/linux/qualcommax/image/ipq807x.mk +++ b/target/linux/qualcommax/image/ipq807x.mk @@ -41,7 +41,8 @@ define Build/wax6xx-netgear-tar md5sum $@.tmp/nand-ipq807x-apps.img | cut -c 1-32 > $@.tmp/nand-ipq807x-apps.md5sum echo $(DEVICE_MODEL) > $@.tmp/metadata.txt echo $(DEVICE_MODEL)"_V99.9.9.9" > $@.tmp/version - tar -C $@.tmp/ -cf $@ . + $(TAR) -C $@.tmp/ -cf $@ --sort=name --numeric-owner --owner=0 --group=0 --mode=go-w \ + $(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") . rm -rf $@.tmp endef diff --git a/target/linux/ramips/image/mt76x8.mk b/target/linux/ramips/image/mt76x8.mk index 173beba69d9..4e9bd2de0c2 100644 --- a/target/linux/ramips/image/mt76x8.mk +++ b/target/linux/ramips/image/mt76x8.mk @@ -19,7 +19,9 @@ define Build/creality_wb-01-factory echo 'mtd_write -o 0 -l $(kernel_size) write $$file Kernel'; \ echo 'mtd_write -r -o $(kernel_size) -l $$rootfs_size write $$file RootFS'; \ ) > $(dir $@)install.sh - tar cjf $@ -C $(dir $@) factory.bin install.sh + $(TAR) -cjf $@ -C $(dir $@) --numeric-owner --owner=0 --group=0 --mode=go-w \ + $(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") \ + factory.bin install.sh endef define Build/elecom-header