mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-12 11:18:37 +04:00
Ryan Leung
f8bb888b03
The Build/haier-sim_wr1800k-factory recipe produced non-reproducible images for two reasons: * openssl aes-256-cbc -salt generates a random salt on every run, which is embedded in the Salted__ header and feeds key derivation, so identical input yields different ciphertext each build. * tar -czf embeds the current time in both the gzip header and records member mtimes, uid/gid and permission bits taken from the build environment (umask-dependent). Fix by encrypting with a fixed salt instead of a random one, and by creating the archive with deterministic tar options (sorted member order, zeroed uid/gid, normalized permissions via --mode=go-w and mtime pinned to SOURCE_DATE_EPOCH when set (guarded by $(if ...)), piped through `gzip -n`. The salt "4f70656e57727421" was obtained from `echo -n 'OpenWrt!' | xxd -p`. Signed-off-by: Ryan Leung <untilscour@protonmail.com> Link: https://github.com/openwrt/openwrt/pull/25605 Signed-off-by: Paul Spooren <mail@aparcar.org>