From 03e596d43d15c177c3c72c388db7a7258b326949 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 1 Jun 2015 13:56:05 +0200
Subject: [PATCH 058/325] release/Makefile: Build the src.txz only once

... and also enforce reproducible source ownership and permissions.

If taring the sources fails, keep the mtree spec.

Keep release/scripts/tar-time-reset.sh for now but update a
comment to make it obvious that the script isn't used anymore.

NB: A previos version of this commit gave directories in
the source tarball 550 permissions. This seems reasonable
at first glance but breaks poudriere builds with unprivileges
users.

Poudriere applies the permissions from the source tarball to
/usr, thus making it unaccesible for users other than root and
members of wheel. While only giving /usr 555 permissions is
sufficient to prevent the issue, treating the directory is
more work and as the source is public anyway it didn't seem
worth it.

Obtained from: ElectroBSD
---
 release/Makefile                  | 31 +++++++++++++++++++++++--------
 release/scripts/tar-time-reset.sh |  8 +++-----
 2 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/release/Makefile b/release/Makefile
index ae839b3aaf07..d90074ada1cc 100644
--- a/release/Makefile
+++ b/release/Makefile
@@ -142,11 +142,29 @@ kernel.txz:
 src.txz:
 	mkdir -p ${DISTDIR}/usr
 	ln -fs ${WORLDDIR} ${DISTDIR}/usr/src
-	cd ${DISTDIR} && tar cLvf - --exclude .svn --exclude .zfs \
-	    --exclude .git --exclude @ --exclude usr/src/release/dist \
-	    --exclude "usr/src/release/*.txz" \
-	    --exclude "usr/src/release/*.orig" usr/src | \
-	    ${XZ_CMD} > ${.OBJDIR}/src.txz
+# Create an mtree spec with faked timestamps so we get a reproducible
+# tar file. We do not use tar for this because its mtree generator
+# appears to be buggy and exits with an memory allocation failure.
+#
+# It's important that the excluded paths start with "./", otherwise
+# file locations are not recorded correctly, and, for example,
+# usr/src/usr.sbin appears as usr/src/release/usr.sbin in the
+# tar file. Only the shadow knows if that's a bug or a feature.
+	echo "./usr/src/.git" >${.OBJDIR}/mtree-exclude
+	echo "./usr/src/release/dist" >>${.OBJDIR}/mtree-exclude
+	echo "./usr/src/release/src.mtree" >>${.OBJDIR}/mtree-exclude
+	echo "./usr/src/release/mtree-exclude" >>${.OBJDIR}/mtree-exclude
+	cd ${DISTDIR} && mtree -c -L -k time -X ${.OBJDIR}/mtree-exclude | \
+	    mtree -C | \
+	    sed -E -e 's@time=[0-9]+\.[0-9]+@time=${EPOCH_DATE}.0 uid=0 gid=0@' \
+		   -e 's@(type=dir)@\1 mode=0555@' \
+		   -e 's@(type=file)@\1 mode=0444@' \
+		   -e 's@//@/@g' \
+	    > ${.OBJDIR}/src.mtree
+	rm ${.OBJDIR}/mtree-exclude
+	cd ${DISTDIR} && tar cLvf - @${.OBJDIR}/src.mtree \
+	    | ${XZ_CMD} > ${.OBJDIR}/src.txz && \
+	rm ${.OBJDIR}/src.mtree
 
 ports.txz:
 	mkdir -p ${DISTDIR}/usr
@@ -246,9 +264,6 @@ mini-memstick.img: bootonly
 	sh ${.CURDIR}/${TARGET}/make-memstick.sh bootonly ${.TARGET}
 
 packagesystem: base.txz kernel.txz ${EXTRA_PACKAGES}
-	for tarball in ${EXTRA_PACKAGES}; do \
-	    sh ${.CURDIR}/scripts/tar-time-reset.sh $${tarball}; \
-	done
 	sh ${.CURDIR}/scripts/make-manifest.sh *.txz > MANIFEST
 	touch ${.TARGET}
 
diff --git a/release/scripts/tar-time-reset.sh b/release/scripts/tar-time-reset.sh
index 8186fd8d3e26..f1b84340286d 100755
--- a/release/scripts/tar-time-reset.sh
+++ b/release/scripts/tar-time-reset.sh
@@ -17,11 +17,9 @@
 ##########################################################################
 #
 # This script resets the timestamps in a given tarfile to hopefully make
-# it reproducible. This is a rather wasteful approach, but works for now.
-#
-# A better solution would be to patch bsdtar to optionally use a fixed
-# time (without having to clown around with mtree specs).
-#
+# it reproducible. As this is a rather wasteful approach the script is
+# no longer used. It hasn't been removed yet as it may be useful for
+# testing purposes.
 ##########################################################################
 
 main() {
-- 
2.32.0