diff options
author | Damien Diederen <dd@crosstwine.com> | 2020-12-30 11:23:45 +0100 |
---|---|---|
committer | Damien Diederen <dd@crosstwine.com> | 2020-12-30 11:37:37 +0100 |
commit | 3363377530931ceac030e66be2be43b75719377b (patch) | |
tree | d51a90318343a50e7b13f1d289b4810b95b55d66 /pkgs/build-support | |
parent | f6188ca545660da0aa722e7a50c1a3952da0a5ef (diff) |
vmTools.debClosureGenerator: Fix non-determinism in dependency graph
By default, Perl versions since 5.8.1 use randomization to make hashes
resistant to complexity attacks.
That randomization makes building VM images such as ubuntu1804x86_64
non-deterministic because the (imported) derivations built by
deb/deb-closure.pl are not stable.
This can easily be observed by repeating the following sequence of
commands and noting the path of the image's .drv:
nix-instantiate -E '(import <nixpkgs> {}).vmTools.diskImageFuns.ubuntu1804x86_64 {}'
nix-store --delete /nix/store/*ubuntu-18.04-bionic-amd64.nix
One source of non-determinism is the handling of Provides/Replaces,
which depends on the order of iteration over %packages. Here is a
diff showing the corresponding change in output:
>>> awk
-virtual awk: using original-awk
- original-awk: libc6 (>= 2.14)
+virtual awk: using mawk
+ mawk: libc6 (>= 2.14)
- mawk: libc6 (>= 2.14)
->>> libc6
This patch sorts packages by name for Provides/Replaces processing,
which seems to result in stable output.
(If the above turns out not to be sufficient, one could also set the
PERL_HASH_SEED and PERL_PERTURB_KEYS environment variables, documented
in 'perlrun', to disable Perl's built-in randomization. Complexity
attacks are not an issue as we control and trust all inputs.)
Diffstat (limited to 'pkgs/build-support')
-rw-r--r-- | pkgs/build-support/vm/deb/deb-closure.pl | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/pkgs/build-support/vm/deb/deb-closure.pl b/pkgs/build-support/vm/deb/deb-closure.pl index bed397d6f07e..fe23025df1d8 100644 --- a/pkgs/build-support/vm/deb/deb-closure.pl +++ b/pkgs/build-support/vm/deb/deb-closure.pl @@ -50,7 +50,7 @@ sub getDeps { # virtual dependencies. my %provides; -foreach my $cdata (values %packages) { +foreach my $cdata (sort {$a->{Package} cmp $b->{Package}} (values %packages)) { if (defined $cdata->{Provides}) { my @provides = getDeps(Dpkg::Deps::deps_parse($cdata->{Provides})); foreach my $name (@provides) { |