Verify mkosi reproducibility #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: © 2026 Phala Network <dstack@phala.network> | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Verify mkosi reproducibility | |
| on: | |
| workflow_dispatch: | |
| concurrency: | |
| group: mkosi-build-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| # These values were produced by two cache-disabled local builds. The job | |
| # checks out this exact source revision so the embedded Git revision and | |
| # SOURCE_DATE_EPOCH are identical. Refresh all three values together. | |
| BASELINE_REVISION: 98df4d5403db271b72cfaae3be742a577f1a2668 | |
| BARE_SHA256: d36fb8862ba8ebe5c99e0481e4e3e67ffc12240950ad28ba8c24dd5c2be5756e | |
| UKI_SHA256: ad07b150fa7541134984ae3de8a320506bc2e5a07893441d3ccb95f3ab5db0f2 | |
| jobs: | |
| cross-host: | |
| name: Compare with local mkosi baseline | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 360 | |
| permissions: | |
| contents: read | |
| steps: | |
| # GitHub-hosted runners have enough CPU and memory for this build, but | |
| # their preinstalled SDKs consume most of the available disk. Remove only | |
| # those unused SDKs before checkout; the OS build itself remains hermetic. | |
| - name: Reclaim runner disk space | |
| run: | | |
| sudo rm -rf \ | |
| /opt/ghc \ | |
| /opt/hostedtoolcache/CodeQL \ | |
| /usr/local/.ghcup \ | |
| /usr/local/lib/android \ | |
| /usr/local/share/boost \ | |
| /usr/share/dotnet | |
| df -h / | |
| - name: Checkout locally verified revision | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ env.BASELINE_REVISION }} | |
| fetch-depth: 0 | |
| - name: Set up Python for mkosi | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.13' | |
| - name: Install pinned mkosi | |
| run: | | |
| python3 -m venv "$RUNNER_TEMP/mkosi-venv" | |
| "$RUNNER_TEMP/mkosi-venv/bin/pip" install --disable-pip-version-check \ | |
| 'mkosi @ git+https://github.com/systemd/mkosi.git@84af20892b61c8e177e391f997ded8b4cb5514f2' | |
| echo "$RUNNER_TEMP/mkosi-venv/bin" >> "$GITHUB_PATH" | |
| - name: Install mkosi host dependencies | |
| run: | | |
| mapfile -t dependencies < <(mkosi --directory os/mkosi dependencies) | |
| sudo apt-get update | |
| sudo apt-get install --yes --no-install-recommends "${dependencies[@]}" | |
| - name: Build without component cache | |
| env: | |
| # ubuntu-latest currently provides four vCPUs and 16 GiB of RAM. | |
| # Do not oversubscribe either the CPU or compiler memory. | |
| JOBS: '4' | |
| run: | | |
| test -z "${DSTACK_DEV_CACHE_DIR:-}" | |
| # GitHub-hosted Ubuntu runners restrict unprivileged user namespaces. | |
| # Run mkosi as root instead of weakening the runner's AppArmor policy. | |
| # Keep setup-python out of the build PATH because Ubuntu's lddtree | |
| # expects the distro Python and its python3-pyelftools module. | |
| ci_bin="$RUNNER_TEMP/mkosi-ci-bin" | |
| mkdir -p "$ci_bin" | |
| ln -s "$(command -v mkosi)" "$ci_bin/mkosi" | |
| sudo --set-home env \ | |
| "PATH=$ci_bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ | |
| "JOBS=$JOBS" \ | |
| ./os/mkosi/build.sh image "$RUNNER_TEMP/mkosi-cross-host" | |
| sudo chown -R "$USER:$USER" "$RUNNER_TEMP/mkosi-cross-host/out" | |
| - name: Compare with local byte-for-byte baseline | |
| run: | | |
| cd "$RUNNER_TEMP/mkosi-cross-host/out/prod" | |
| tar -xOf dstack-0.6.0.tar.gz dstack-0.6.0/sha256sum.txt | |
| tar -xOf dstack-0.6.0.tar.gz dstack-0.6.0/metadata.json | |
| mkdir "$RUNNER_TEMP/rootfs-inspect" | |
| sudo unsquashfs -d "$RUNNER_TEMP/rootfs-inspect" -o 1048576 \ | |
| dstack-0.6.0/rootfs.img.parted.verity >/dev/null | |
| sudo chown -R "$USER:$USER" "$RUNNER_TEMP/rootfs-inspect" | |
| (cd "$RUNNER_TEMP/rootfs-inspect" && \ | |
| find . -type f -print0 | sort -z | xargs -0 sha256sum) \ | |
| > rootfs-files.sha256 | |
| (cd "$RUNNER_TEMP/rootfs-inspect" && \ | |
| find . -printf '%y %m %u:%g %p -> %l\n' | sort) \ | |
| > rootfs-tree.txt | |
| sha256sum dstack-0.6.0.tar.gz dstack-0.6.0-uki.tar.gz \ | |
| | tee cross-host.sha256 | |
| printf '%s %s\n' "$BARE_SHA256" dstack-0.6.0.tar.gz \ | |
| | sha256sum --check --strict | |
| printf '%s %s\n' "$UKI_SHA256" dstack-0.6.0-uki.tar.gz \ | |
| | sha256sum --check --strict | |
| - name: Upload verification record | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: mkosi-cross-host-sha256 | |
| path: | | |
| ${{ runner.temp }}/mkosi-cross-host/out/prod/cross-host.sha256 | |
| ${{ runner.temp }}/mkosi-cross-host/out/prod/rootfs-files.sha256 | |
| ${{ runner.temp }}/mkosi-cross-host/out/prod/rootfs-tree.txt | |
| retention-days: 30 |