Ysphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget./translations/zh_CN/kbuild/reproducible-buildsmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/zh_TW/kbuild/reproducible-buildsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/it_IT/kbuild/reproducible-buildsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/ja_JP/kbuild/reproducible-buildsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/ko_KR/kbuild/reproducible-buildsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/sp_SP/kbuild/reproducible-buildsmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhsection)}(hhh](htitle)}(hReproducible buildsh]hReproducible builds}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhH/var/lib/git/docbuild/linux/Documentation/kbuild/reproducible-builds.rsthKubh paragraph)}(hXIt is generally desirable that building the same source code with the same set of tools is reproducible, i.e. the output is always exactly the same. This makes it possible to verify that the build infrastructure for a binary distribution or embedded system has not been subverted. This can also make it easier to verify that a source or tool change does not make any difference to the resulting binaries.h]hXIt is generally desirable that building the same source code with the same set of tools is reproducible, i.e. the output is always exactly the same. This makes it possible to verify that the build infrastructure for a binary distribution or embedded system has not been subverted. This can also make it easier to verify that a source or tool change does not make any difference to the resulting binaries.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hThe `Reproducible Builds project`_ has more information about this general topic. This document covers the various reasons why building the kernel may be unreproducible, and how to avoid them.h](hThe }(hhhhhNhNubh reference)}(h`Reproducible Builds project`_h]hReproducible Builds project}(hhhhhNhNubah}(h]h ]h"]h$]h&]nameReproducible Builds projectrefuri https://reproducible-builds.org/uh1hhhnjresolvedKubh has more information about this general topic. This document covers the various reasons why building the kernel may be unreproducible, and how to avoid them.}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](h)}(h Timestampsh]h Timestamps}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh)}(h-The kernel embeds timestamps in three places:h]h-The kernel embeds timestamps in three places:}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh bullet_list)}(hhh](h list_item)}(hLThe version string exposed by ``uname()`` and included in ``/proc/version`` h]h)}(hKThe version string exposed by ``uname()`` and included in ``/proc/version``h](hThe version string exposed by }(hjhhhNhNubhliteral)}(h ``uname()``h]huname()}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh and included in }(hjhhhNhNubj!)}(h``/proc/version``h]h /proc/version}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h*File timestamps in the embedded initramfs h]h)}(h)File timestamps in the embedded initramfsh]h)File timestamps in the embedded initramfs}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjNubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hIf enabled via ``CONFIG_IKHEADERS``, file timestamps of kernel headers embedded in the kernel or respective module, exposed via ``/sys/kernel/kheaders.tar.xz`` h]h)}(hIf enabled via ``CONFIG_IKHEADERS``, file timestamps of kernel headers embedded in the kernel or respective module, exposed via ``/sys/kernel/kheaders.tar.xz``h](hIf enabled via }(hjjhhhNhNubj!)}(h``CONFIG_IKHEADERS``h]hCONFIG_IKHEADERS}(hjrhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjjubh], file timestamps of kernel headers embedded in the kernel or respective module, exposed via }(hjjhhhNhNubj!)}(h``/sys/kernel/kheaders.tar.xz``h]h/sys/kernel/kheaders.tar.xz}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjjubeh}(h]h ]h"]h$]h&]uh1hhhhKhjfubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]bullet*uh1j hhhKhhhhubh)}(hBy default the timestamp is the current time and in the case of ``kheaders`` the various files' modification times. This must be overridden using the `KBUILD_BUILD_TIMESTAMP`_ variable. If you are building from a git commit, you could use its commit date.h](h@By default the timestamp is the current time and in the case of }(hjhhhNhNubj!)}(h ``kheaders``h]hkheaders}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubhL the various files’ modification times. This must be overridden using the }(hjhhhNhNubh)}(h`KBUILD_BUILD_TIMESTAMP`_h]hKBUILD_BUILD_TIMESTAMP}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameKBUILD_BUILD_TIMESTAMPh"kbuild.html#kbuild-build-timestampuh1hhjhKubhP variable. If you are building from a git commit, you could use its commit date.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hXThe kernel does *not* use the ``__DATE__`` and ``__TIME__`` macros, and enables warnings if they are used. If you incorporate external code that does use these, you must override the timestamp they correspond to by setting the `SOURCE_DATE_EPOCH`_ environment variable.h](hThe kernel does }(hjhhhNhNubhemphasis)}(h*not*h]hnot}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh use the }(hjhhhNhNubj!)}(h ``__DATE__``h]h__DATE__}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh and }(hjhhhNhNubj!)}(h ``__TIME__``h]h__TIME__}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh macros, and enables warnings if they are used. If you incorporate external code that does use these, you must override the timestamp they correspond to by setting the }(hjhhhNhNubh)}(h`SOURCE_DATE_EPOCH`_h]hSOURCE_DATE_EPOCH}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameSOURCE_DATE_EPOCHh7https://reproducible-builds.org/docs/source-date-epoch/uh1hhjhKubh environment variable.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK#hhhhubeh}(h] timestampsah ]h"] timestampsah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h User, hosth]h User, host}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj>hhhhhK*ubh)}(hThe kernel embeds the building user and host names in ``/proc/version``. These must be overridden using the `KBUILD_BUILD_USER and KBUILD_BUILD_HOST`_ variables. If you are building from a git commit, you could use its committer address.h](h6The kernel embeds the building user and host names in }(hjOhhhNhNubj!)}(h``/proc/version``h]h /proc/version}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjOubh&. These must be overridden using the }(hjOhhhNhNubh)}(h*`KBUILD_BUILD_USER and KBUILD_BUILD_HOST`_h]h'KBUILD_BUILD_USER and KBUILD_BUILD_HOST}(hjihhhNhNubah}(h]h ]h"]h$]h&]name'KBUILD_BUILD_USER and KBUILD_BUILD_HOSTh/kbuild.html#kbuild-build-user-kbuild-build-hostuh1hhjOhKubhX variables. If you are building from a git commit, you could use its committer address.}(hjOhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK,hj>hhubeh}(h] user-hostah ]h"] user, hostah$]h&]uh1hhhhhhhhK*ubh)}(hhh](h)}(h"Generated files in source packagesh]h"Generated files in source packages}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK2ubh)}(hXbThe build processes for some programs under the ``tools/`` subdirectory do not completely support out-of-tree builds. This may cause a later source package build using e.g. ``make rpm-pkg`` to include generated files. You should ensure the source tree is pristine by running ``make mrproper`` or ``git clean -d -f -x`` before building a source package.h](h0The build processes for some programs under the }(hjhhhNhNubj!)}(h ``tools/``h]htools/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubht subdirectory do not completely support out-of-tree builds. This may cause a later source package build using e.g. }(hjhhhNhNubj!)}(h``make rpm-pkg``h]h make rpm-pkg}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubhW to include generated files. You should ensure the source tree is pristine by running }(hjhhhNhNubj!)}(h``make mrproper``h]h make mrproper}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh or }(hjhhhNhNubj!)}(h``git clean -d -f -x``h]hgit clean -d -f -x}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh" before building a source package.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK4hjhhubeh}(h]"generated-files-in-source-packagesah ]h"]"generated files in source packagesah$]h&]uh1hhhhhhhhK2ubh)}(hhh](h)}(hModule signingh]hModule signing}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKhjhhubh)}(hrOne approach to this is to divide up the build process so that the unreproducible parts can be treated as sources:h]hrOne approach to this is to divide up the build process so that the unreproducible parts can be treated as sources:}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKChjhhubhenumerated_list)}(hhh](j)}(hZGenerate a persistent signing key. Add the certificate for the key to the kernel source. h]h)}(hYGenerate a persistent signing key. Add the certificate for the key to the kernel source.h]hYGenerate a persistent signing key. Add the certificate for the key to the kernel source.}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKFhj?ubah}(h]h ]h"]h$]h&]uh1jhj<hhhhhNubj)}(hSet the ``CONFIG_SYSTEM_TRUSTED_KEYS`` symbol to include the signing key's certificate, set ``CONFIG_MODULE_SIG_KEY`` to an empty string, and disable ``CONFIG_MODULE_SIG_ALL``. Build the kernel and modules. h]h)}(hSet the ``CONFIG_SYSTEM_TRUSTED_KEYS`` symbol to include the signing key's certificate, set ``CONFIG_MODULE_SIG_KEY`` to an empty string, and disable ``CONFIG_MODULE_SIG_ALL``. Build the kernel and modules.h](hSet the }(hj[hhhNhNubj!)}(h``CONFIG_SYSTEM_TRUSTED_KEYS``h]hCONFIG_SYSTEM_TRUSTED_KEYS}(hjchhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[ubh8 symbol to include the signing key’s certificate, set }(hj[hhhNhNubj!)}(h``CONFIG_MODULE_SIG_KEY``h]hCONFIG_MODULE_SIG_KEY}(hjuhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[ubh! to an empty string, and disable }(hj[hhhNhNubj!)}(h``CONFIG_MODULE_SIG_ALL``h]hCONFIG_MODULE_SIG_ALL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[ubh. Build the kernel and modules.}(hj[hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKIhjWubah}(h]h ]h"]h$]h&]uh1jhj<hhhhhNubj)}(hICreate detached signatures for the modules, and publish them as sources. h]h)}(hHCreate detached signatures for the modules, and publish them as sources.h]hHCreate detached signatures for the modules, and publish them as sources.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKNhjubah}(h]h ]h"]h$]h&]uh1jhj<hhhhhNubj)}(h|Perform a second build that attaches the module signatures. It can either rebuild the modules or use the output of step 2. h]h)}(h{Perform a second build that attaches the module signatures. It can either rebuild the modules or use the output of step 2.h]h{Perform a second build that attaches the module signatures. It can either rebuild the modules or use the output of step 2.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKQhjubah}(h]h ]h"]h$]h&]uh1jhj<hhhhhNubeh}(h]h ]h"]h$]h&]enumtypearabicprefixhsuffix.uh1j:hjhhhhhKFubeh}(h]module-signingah ]h"]module signingah$]h&]uh1hhhhhhhhK.. _KBUILD_BUILD_TIMESTAMP: kbuild.html#kbuild-build-timestamph]h}(h]kbuild-build-timestampah ]h"]kbuild_build_timestampah$]h&]hjuh1jhKuhjhhhh referencedKubj)}(h\.. _KBUILD_BUILD_USER and KBUILD_BUILD_HOST: kbuild.html#kbuild-build-user-kbuild-build-hosth]h}(h]'kbuild-build-user-and-kbuild-build-hostah ]h"]'kbuild_build_user and kbuild_build_hostah$]h&]hjyuh1jhKvhjhhhhjKubj)}(hA.. _Reproducible Builds project: https://reproducible-builds.org/h]h}(h]reproducible-builds-projectah ]h"]reproducible builds projectah$]h&]hhuh1jhKwhjhhhhjKubj)}(hN.. _SOURCE_DATE_EPOCH: https://reproducible-builds.org/docs/source-date-epoch/h]h}(h]source-date-epochah ]h"]source_date_epochah$]h&]hj+uh1jhKxhjhhhhjKubeh}(h]gitah ]h"]gitah$]h&]uh1hhhhhhhhKlubeh}(h]reproducible-buildsah ]h"]reproducible buildsah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjgerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(reproducible builds project]hakbuild_build_timestamp]jasource_date_epoch]ja'kbuild_build_user and kbuild_build_host]jiaurefids}nameids}(jAj>j;j8jjjjjjjBj?jjj9j6j j jjj%j"j1j.u nametypes}(jAj;jjjjBjj9j jj%j1uh}(j>hj8hjj>jjjjj?jjjEj6jj jjjj"jj.j(u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.