Linux CPIO – Practical Way to Make Binary-Reproducible CPIO Archives

cpiolinuxreproducible-buildshell

I would like my initramfs to have the same hash no matter when or where I build it if the contents of the files are the same (and are owned by root and have same permissions). I don't see any options in GNU cpio to strip or set timestamps of files in the archive. Is there a relatively standard way to massage the input to cpio and other archive programs so you can get reproducible products?

Going along with this, is there a conventional "We aren't giving this a date" timestamp? Something most software won't wig out about? For example 0 epoch-seconds?

For example, if I did a find pass on an input directory for an initramfs and manually set all the timestamps to 0, could I build that archive, extract it on another system, repeat the process, and build it again and get bit-identical files?

Best Answer

Newer versions of GNU cpio have a --reproducible flag which goes some way towards your requirements. My understanding is that the strip-nondeterminism tool will handle the timestamp requirement after the fact. touch will allow you to set the time before you package of course.

Related Question