From f8bb888b0303c4d0d5fc8bec909a76e15ed40cba Mon Sep 17 00:00:00 2001 From: Ryan Leung Date: Sun, 4 Oct 2026 22:43:51 +0800 Subject: [PATCH] ramips: mt7621: make haier-sim_wr1800k factory image reproducible The Build/haier-sim_wr1800k-factory recipe produced non-reproducible images for two reasons: * openssl aes-256-cbc -salt generates a random salt on every run, which is embedded in the Salted__ header and feeds key derivation, so identical input yields different ciphertext each build. * tar -czf embeds the current time in both the gzip header and records member mtimes, uid/gid and permission bits taken from the build environment (umask-dependent). Fix by encrypting with a fixed salt instead of a random one, and by creating the archive with deterministic tar options (sorted member order, zeroed uid/gid, normalized permissions via --mode=go-w and mtime pinned to SOURCE_DATE_EPOCH when set (guarded by $(if ...)), piped through `gzip -n`. The salt "4f70656e57727421" was obtained from `echo -n 'OpenWrt!' | xxd -p`. Signed-off-by: Ryan Leung Link: https://github.com/openwrt/openwrt/pull/25605 Signed-off-by: Paul Spooren --- target/linux/ramips/image/mt7621.mk | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk index 8fba65e0ec6..d2ba00f85ad 100644 --- a/target/linux/ramips/image/mt7621.mk +++ b/target/linux/ramips/image/mt7621.mk @@ -120,8 +120,13 @@ define Build/haier-sim_wr1800k-factory mkdir -p "$@.tmp" mv "$@" "$@.tmp/UploadBrush-bin.img" $(MKHASH) md5 "$@.tmp/UploadBrush-bin.img" | head -c32 > "$@.tmp/check_MD5.txt" - $(TAR) -czf "$@.tmp.tgz" -C "$@.tmp" UploadBrush-bin.img check_MD5.txt - $(STAGING_DIR_HOST)/bin/openssl aes-256-cbc -e -salt -in "$@.tmp.tgz" -out "$@" -k QiLunSmartWL + $(TAR) -C "$@.tmp" \ + --numeric-owner --owner=0 --group=0 --mode=go-w --sort=name \ + $(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") \ + -cf - UploadBrush-bin.img check_MD5.txt | gzip -n -9 > "$@.tmp.tgz" + $(STAGING_DIR_HOST)/bin/openssl aes-256-cbc -e \ + -S 4f70656e57727421 \ + -in "$@.tmp.tgz" -out "$@" -k QiLunSmartWL printf %32s $(DEVICE_MODEL) >> "$@" rm -rf "$@.tmp" "$@.tmp.tgz" endef