make cpio reproducible

[bsandu-peridio]

No description provided.

[Copilot]

Pull request overview

This PR aims to make initramfs cpio outputs reproducible by normalizing filesystem mtimes in the staged initramfs tree before the archive is created.

Changes:

• Add a build-script step that normalizes mtimes under $INITRAMFS_WORK to SOURCE_DATE_EPOCH (defaulting to 0).
• Add unit tests that assert the mtime-normalization step is emitted and ordered correctly relative to release-file injection and cpio creation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/commands/initramfs/image.rs:129

• You pin LC_ALL=C for the cpio entry sort to avoid locale-driven archive drift, but the initramfs build ID is also derived from a locale-sensitive sort of RPM NEVRAs earlier in this generated script (rpm -qa ... | sort). If the SDK/container ever gains additional locales or forwards LC_* from the host, the same package set could produce a different INITRAMFS_BUILD_ID. Consider pinning that earlier sort to LC_ALL=C as well.

    # Reproducibility notes for the pipeline below:
    #   * `LC_ALL=C sort` — entry order is archive order (and, with
    #     --renumber-inodes, decides the inode numbers), so collation must not
    #     drift. Today's SDK ships only the C/POSIX locales, which makes this a
    #     no-op, but it stops the archive from changing if the image ever gains
    #     real locales or the CLI starts forwarding the host's LC_* vars.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/commands/initramfs/image.rs:126

• xargs passes arbitrary filenames from the staged tree into touch. If any path begins with -, touch can interpret it as an option. Add -- after the touch options so all subsequent arguments are treated as paths.

        | xargs -0r touch -h -d "@${{SOURCE_DATE_EPOCH:-0}}"