Skip to content

modules/musl-cross-make: fix cross-compiler reproducibility - #2173

Open
tlaurion wants to merge 1 commit into
linuxboot:masterfrom
tlaurion:fix-musl-cross-make-binutils
Open

modules/musl-cross-make: fix cross-compiler reproducibility#2173
tlaurion wants to merge 1 commit into
linuxboot:masterfrom
tlaurion:fix-musl-cross-make-binutils

Conversation

@tlaurion

Copy link
Copy Markdown
Collaborator

The musl-cross-make version bump (fd6be58 -> 227df8b) upgraded binutils
from 2.33.1 to 2.44. Gas 2.44 introduced section-end padding by default
and changed NOP padding behavior on x86, making object file output
non-deterministic between build runs.

Fix:

  • Pass -Wa,--no-pad-sections via CFLAGS to restore gas 2.33.1 behavior
  • Disable debug section compression (--enable-compressed-debug-sections=no)

Additionally fix two pre-existing reproducibility gaps:

  • Override BUILD triplet (x86_64-pc-linux-gnu) via config.mak to prevent
    config.guess from probing the Docker host kernel (different CI runners
    have different host kernels)
  • Export SOURCE_DATE_EPOCH from the pinned musl-cross-make commit epoch
    to prevent DATE/TIME embedding during the GCC build

Expected: two clean builds of the same commit produce identical
cross-compiler output regardless of which CI runner executes the build.

Three changes to make musl-cross-make produce deterministic GCC 9.4.0 output:

1. Override BUILD triplet via config.mak to prevent config.guess from
   probing the Docker host kernel (Docker shares host kernel, different
   CircleCI runners produce different triplets).

2. Export SOURCE_DATE_EPOCH from the pinned commit epoch to prevent
   __DATE__/__TIME__ embedding during the GCC build.

3. Pass -Wa,--no-pad-sections via CFLAGS to prevent gas 2.44 section-end
   padding, and --enable-compressed-debug-sections=no to disable
   non-deterministic debug section compression.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Copilot AI review requested due to automatic review settings July 29, 2026 20:28

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Mismatch between hashes of local build and Circle public build of bin/gpg-agent

2 participants