diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 83e1fb6..1dad3ba 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -40,4 +40,4 @@ jobs: - run: ./builder/build.sh -c -B MYCOOLARG=iLikeTests centos-7 # Do a reproducible rocky-8 build (does not work for centos-7) - run: ../tests/test-rocky-8-reproducible.sh - + - run: ../tests/test-rocky-9-reproducible.sh diff --git a/demo/builder-support/dockerfiles/Dockerfile.target.rocky-9 b/demo/builder-support/dockerfiles/Dockerfile.target.rocky-9 new file mode 100644 index 0000000..042f30c --- /dev/null +++ b/demo/builder-support/dockerfiles/Dockerfile.target.rocky-9 @@ -0,0 +1,24 @@ +# First do the source builds +@INCLUDE Dockerfile.target.sdist + +# This defines the distribution base layer +# Put only the bare minimum of common commands here, without dev tools +FROM rockylinux:9 as dist-base +ARG BUILDER_CACHE_BUSTER= +#RUN dnf install -y epel-release +# Python 3.4+ is needed for the builder helpers +RUN dnf install -y /usr/bin/python3 +RUN dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm +RUN dnf install -y dnf-plugins-core +RUN dnf config-manager --set-enabled crb + +# Do the actual rpm build +@INCLUDE Dockerfile.rpmbuild + +# Generate provenance +RUN /build/builder/helpers/generate-dnf-provenance.py /dist/rpm-provenance.json + +# Do a test install and verify +# Can be skipped with skiptests=1 in the environment +@EXEC [ "$skiptests" = "" ] && include Dockerfile.rpmtest + diff --git a/tests/test-rocky-9-reproducible.sh b/tests/test-rocky-9-reproducible.sh new file mode 100755 index 0000000..0c332e8 --- /dev/null +++ b/tests/test-rocky-9-reproducible.sh @@ -0,0 +1,23 @@ +#!/bin/sh +# Test if rocky-9 RPM builds are reproducible +# Must be run from demo dir + +set -ex + +# First build +./builder/build.sh -B MYCOOLARG=iLikeTests rocky-9 + +# Record hashes +sha256sum \ + builder/tmp/latest/rocky-9/dist/noarch/*.rpm \ + builder/tmp/latest/sdist/*.tar.gz \ + > /tmp/sha256sum.txt + +# Second build after cleaning and adding a file to invalidate the build context +rm -rf ./builder/tmp/latest/rocky-9 +rm -rf ./builder/tmp/latest/sdist +./builder/build.sh -B MYCOOLARG=iLikeTests -b build-again rocky-9 + +# Check hashes, should be identical +sha256sum -c /tmp/sha256sum.txt +