mbox series

[v2,0/2] Fix reproducibility of /etc/shadow file when image built on different days

Message ID 20240306061423.1088541-1-Adithya.Balakumar@toshiba-tsip.com
Headers show
Series Fix reproducibility of /etc/shadow file when image built on different days | expand

Message

Adithya Balakumar March 6, 2024, 6:14 a.m. UTC 
The third field in the /etc/shadow file (sp_lstchg) contains the date of
the last password change expressed as the number of days since Jan 1, 1970.
As this is a relative time, creating a user today will result in:

username:17238:0:99999:7:::
whilst creating the same user tomorrow will result in:

username:17239:0:99999:7:::

This impacts reproducibility of images when built on different days.

Since /etc/shadow honours SOURCE_DATE_EPOCH, this patchset makes the
SOURCE_DATE_EPOCH variable available when the /etc/shadow file is
created/modified.

Changes in v2:
- Replaced "! -z" with "-n" while checking for value of SOURCE_DATE_EPOCH
- Handle failure if bitbake var for SOURCE_DATE_EPOCH is empty

Adithya Balakumar (2):
  isar-bootstrap.inc: Export SOURCE_DATE_EPOCH variable
  image-account-extension.bbclass: Export SOURCE_DATE_EPOCH variable

 meta/classes/image-account-extension.bbclass        | 4 ++++
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 4 ++++
 2 files changed, 8 insertions(+)

Comments

Uladzimir Bely March 11, 2024, 12:09 p.m. UTC | #1 
On Wed, 2024-03-06 at 11:44 +0530, Adithya Balakumar wrote:
> The third field in the /etc/shadow file (sp_lstchg) contains the date
> of
> the last password change expressed as the number of days since Jan 1,
> 1970.
> As this is a relative time, creating a user today will result in:
> 
> username:17238:0:99999:7:::
> whilst creating the same user tomorrow will result in:
> 
> username:17239:0:99999:7:::
> 
> This impacts reproducibility of images when built on different days.
> 
> Since /etc/shadow honours SOURCE_DATE_EPOCH, this patchset makes the
> SOURCE_DATE_EPOCH variable available when the /etc/shadow file is
> created/modified.
> 
> Changes in v2:
> - Replaced "! -z" with "-n" while checking for value of
> SOURCE_DATE_EPOCH
> - Handle failure if bitbake var for SOURCE_DATE_EPOCH is empty
> 
> Adithya Balakumar (2):
>   isar-bootstrap.inc: Export SOURCE_DATE_EPOCH variable
>   image-account-extension.bbclass: Export SOURCE_DATE_EPOCH variable
> 
>  meta/classes/image-account-extension.bbclass        | 4 ++++
>  meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 4 ++++
>  2 files changed, 8 insertions(+)
> 
> -- 
> 2.39.2
> 
> 

Applied to next, thanks.