diff mbox series

[meta-networking,v2] nftables: improve reproducibility

Message ID 20260512121234.1779664-1-yi.zhao@windriver.com
State New
Headers show
Series [meta-networking,v2] nftables: improve reproducibility | expand

Commit Message

Yi Zhao May 12, 2026, 12:12 p.m. UTC 
Use SOURCE_DATE_EPOCH to set MAKE_STAMP instead of using the current
time, thereby improving reproducibility.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 ...URCE_DATE_EPOCH-for-build-time-stamp.patch | 41 +++++++++++++++++++
 .../recipes-filter/nftables/nftables_1.1.6.bb |  1 +
 2 files changed, 42 insertions(+)
 create mode 100644 meta-networking/recipes-filter/nftables/nftables/0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-filter/nftables/nftables/0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch b/meta-networking/recipes-filter/nftables/nftables/0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch
new file mode 100644
index 0000000000..f52ff28b21
--- /dev/null
+++ b/meta-networking/recipes-filter/nftables/nftables/0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch
@@ -0,0 +1,41 @@ 
+From fde27e62b241fb7d96de36a2fd6d7879c24f5de6 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Wed, 28 Jan 2026 18:31:07 +0000
+Subject: [PATCH] build: support `SOURCE_DATE_EPOCH` for build time-stamp
+
+In order to support reproducible builds, set the build time-stamp to the value
+of the environment variable, `SOURCE_DATE_EPOCH`, if set, and fall back to
+calling `date`, otherwise.
+
+Link: https://reproducible-builds.org/docs/source-date-epoch/
+Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
+Reported-by: Arnout Engelen <arnout@bzzt.net>
+Closes: https://github.com/NixOS/nixpkgs/issues/478048
+Suggested-by: Philipp Bartsch <phil@grmr.de>
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Upstream-Status: Backport [https://git.netfilter.org/nftables/commit/?id=ca86f206c92704170a295b8dc7a41f6448835dde]
+[Adjust patch for 1.1.6]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 6825474..527049f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -165,7 +165,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
+ ])
+ # Current date should be fetched exactly once per build,
+ # so have 'make' call date and pass the value to every 'gcc' call
+-AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
++AC_SUBST([MAKE_STAMP], ["${SOURCE_DATE_EPOCH:-$(date +%s)}"])
+ 
+ AC_ARG_ENABLE([distcheck],
+ 	      AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
+-- 
+2.34.1
+
diff --git a/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb b/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb
index d27e60a18d..cc57db3c81 100644
--- a/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb
+++ b/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb
@@ -12,6 +12,7 @@  DEPENDS = "libmnl libnftnl bison-native \
            ${@bb.utils.contains('PACKAGECONFIG', 'mini-gmp', '', 'gmp', d)}"
 
 SRC_URI = "http://www.netfilter.org/projects/nftables/files/${BP}.tar.xz \
+           file://0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch \
            file://run-ptest \
           "
 SRC_URI[sha256sum] = "372931bda8556b310636a2f9020adc710f9bab66f47efe0ce90bff800ac2530c"