diff options
author | Antoine Eiche <lewo@abesis.fr> | 2018-03-12 17:06:21 +0100 |
---|---|---|
committer | Antoine Eiche <lewo@abesis.fr> | 2018-03-13 13:46:41 +0100 |
commit | 346996ceecc421577be638b9aac4917925329130 (patch) | |
tree | 818a540e8244dca631acefc2b1dd177b3f42dbc3 /pkgs/build-support/docker | |
parent | a682ba23d49cd13c92922af3d5dc44efd60ae9e7 (diff) | |
download | nixlib-346996ceecc421577be638b9aac4917925329130.tar nixlib-346996ceecc421577be638b9aac4917925329130.tar.gz nixlib-346996ceecc421577be638b9aac4917925329130.tar.bz2 nixlib-346996ceecc421577be638b9aac4917925329130.tar.lz nixlib-346996ceecc421577be638b9aac4917925329130.tar.xz nixlib-346996ceecc421577be638b9aac4917925329130.tar.zst nixlib-346996ceecc421577be638b9aac4917925329130.zip |
dockerTools: dereference hard links in tar archives
This is to improve image creation reproducibility. Since the nar format doesn't support hard link, the tar stream of a layer can be different if a dependency of a layer has been built locally or if it has been fetched from a binary cache. If the dependency has been build locally, it can contain hard links which are encoded in the tar stream. If the dependency has been fetched from a binary cache, the tar stream doesn't contain any hard link. So even if the content is the same, tar streams are different.
Diffstat (limited to 'pkgs/build-support/docker')
-rw-r--r-- | pkgs/build-support/docker/default.nix | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix index c40b096e2088..328419d639f9 100644 --- a/pkgs/build-support/docker/default.nix +++ b/pkgs/build-support/docker/default.nix @@ -212,7 +212,7 @@ rec { postMount = '' echo "Packing raw image..." - tar -C mnt --mtime="@$SOURCE_DATE_EPOCH" -cf $out . + tar -C mnt --hard-dereference --mtime="@$SOURCE_DATE_EPOCH" -cf $out . ''; }; @@ -277,7 +277,7 @@ rec { # Tar up the layer and throw it into 'layer.tar'. echo "Packing layer..." mkdir $out - tar -C layer --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf $out/layer.tar . + tar -C layer --hard-dereference --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf $out/layer.tar . # Compute a checksum of the tarball. echo "Computing layer checksum..." @@ -359,7 +359,7 @@ rec { echo "Packing layer..." mkdir $out - tar -C layer --mtime="@$SOURCE_DATE_EPOCH" -cf $out/layer.tar . + tar -C layer --hard-dereference --mtime="@$SOURCE_DATE_EPOCH" -cf $out/layer.tar . # Compute the tar checksum and add it to the output json. echo "Computing checksum..." @@ -489,7 +489,7 @@ rec { comm <(sort -n baseFiles|uniq) \ <(sort -n layerFiles|uniq|grep -v ${layer}) -1 -3 > newFiles # Append the new files to the layer. - tar -rpf temp/layer.tar --mtime="@$SOURCE_DATE_EPOCH" \ + tar -rpf temp/layer.tar --hard-dereference --mtime="@$SOURCE_DATE_EPOCH" \ --owner=0 --group=0 --no-recursion --files-from newFiles echo "Adding meta..." @@ -537,7 +537,7 @@ rec { chmod -R a-w image echo "Cooking the image..." - tar -C image --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 --xform s:'./':: -c . | pigz -nT > $out + tar -C image --hard-dereference --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 --xform s:'./':: -c . | pigz -nT > $out echo "Finished." ''; |