fix(os): canonicalize squashfs input stream

Author: kvinwang

os/mkosi/scripts/make-release-artifacts.sh

@@ -24,11 +24,16 @@ rootfs="$OUT/files/rootfs.squashfs.verity"
 truncate -s 0 "$rootfs"
 # Privileged mkosi runs can inherit host default ACLs from their workspace.
 # The guest rootfs does not rely on xattrs, so exclude this host-only metadata.
-# A single compressor worker also avoids host-CPU-dependent fragment ordering.
-env -u SOURCE_DATE_EPOCH mksquashfs "$TREE" "$rootfs" \
-  -noappend -all-root -no-progress \
-  -no-xattrs -processors 1 -comp zstd -mkfs-time "$SOURCE_DATE_EPOCH" \
-  -all-time "$SOURCE_DATE_EPOCH" >/dev/null
+# A sorted tar stream also removes backing-filesystem directory/inode order and
+# hardlink topology from the input. A single compressor worker then avoids
+# host-CPU-dependent fragment ordering.
+(cd "$TREE" && tar --sort=name --format=gnu \
+  --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 --numeric-owner \
+  --hard-dereference -cf - .) | \
+  env -u SOURCE_DATE_EPOCH mksquashfs - "$rootfs" -tar \
+    -noappend -all-root -no-progress -exports -no-hardlinks -no-tailends \
+    -no-xattrs -processors 1 -comp zstd -mkfs-time "$SOURCE_DATE_EPOCH" \
+    -all-time "$SOURCE_DATE_EPOCH" >/dev/null
 data_size=$(stat -c %s "$rootfs")
 data_size=$(( (data_size + 4095) / 4096 * 4096 ))
 truncate -s "$data_size" "$rootfs"

os/mkosi/tests/acceptance.sh

@@ -29,6 +29,8 @@ for service in dstack-guest-agent dstack-prepare app-compose wg-checker; do
   grep -q "$service" "$D/mkosi.skeleton/usr/lib/systemd/system-preset/80-dstack.preset"
 done
 grep -q 'artifact-manifest.json' "$D/scripts/make-release-artifacts.sh"
+grep -q -- '--hard-dereference' "$D/scripts/make-release-artifacts.sh"
+grep -q 'mksquashfs -.*-tar' "$D/scripts/make-release-artifacts.sh"
 grep -q 'image/assemble.sh' "$D/mkosi.postoutput"
 grep -q 'ovmf-build.sh' "$D/components/ovmf/ovmf.sh"
 grep -q 'fbe0805b2091393406952e84724188f8c1941837' "$D/components/ovmf/ovmf-build.sh"