reproducible build error #436
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Added CMAKE_SKIP_BUILD_RPATH flag to enable reproducible builds This change ensures that builds are more deterministic by preventing the inclusion of build-specific RPATH information in binaries The flag is added to DEB_CMAKE_EXTRA_FLAGS and passed to dh_auto_configure This improves package consistency across different build environments Influence: 1. Verify that builds produce identical binaries when built multiple times 2. Test package installation and functionality remains unchanged 3. Check that RPATH information is properly handled in the final binaries 4. Ensure compatibility with existing build systems and packaging tools feat: 添加可重复编译参数 添加 CMAKE_SKIP_BUILD_RPATH 标志以启用可重复编译 此更改通过防止在二进制文件中包含构建特定的 RPATH 信息 确保构建更加确定性和一致 该标志被添加到 DEB_CMAKE_EXTRA_FLAGS 并传递给 dh_auto_configure 这提高了不同构建环境中软件包的一致性 Influence: 1. 验证多次构建时是否产生相同的二进制文件 2. 测试软件包安装和功能保持不变 3. 检查最终二进制文件中的 RPATH 信息是否正确处理 4. 确保与现有构建系统和打包工具的兼容性
Removed the hardcoded CMAKE_CXX_FLAGS with "-g -Wall" from CMakeLists.txt. This change allows for more flexible build configuration by letting CMake handle default compiler flags and enabling developers to override flags through CMake variables or command line arguments. The debug symbols and warnings can still be enabled through standard CMake build types (Debug, Release, etc.) or custom configurations. Influence: 1. Test building with different CMake build types (Debug, Release) 2. Verify that debug symbols are still available in Debug builds 3. Check that compiler warnings can be controlled through standard CMake mechanisms 4. Ensure build system remains compatible with existing development workflows chore: 从 CMake 中移除硬编码的调试标志 从 CMakeLists.txt 中移除了硬编码的 CMAKE_CXX_FLAGS 设置（"-g -Wall"）。 此更改允许更灵活的构建配置，让 CMake 处理默认编译器标志，并允许开发者通 过 CMake 变量或命令行参数覆盖标志。调试符号和警告仍可通过标准的 CMake 构 建类型（Debug、Release 等）或自定义配置启用。 Influence: 1. 测试使用不同 CMake 构建类型（Debug、Release）进行构建 2. 验证在 Debug 构建中调试符号仍然可用 3. 检查编译器警告是否可以通过标准 CMake 机制控制 4. 确保构建系统与现有开发工作流程保持兼容
18202781743
requested review from
BLumia,
fly602,
mhduiy,
robertkill,
wjyrich and
yixinshark
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR refactors the build configuration to enable reproducible and secure builds by removing hardcoded debug flags, injecting security-focused compiler definitions in CMake, and updating the Debian rules to propagate reproducible build parameters. Flow diagram for secure and reproducible build configurationflowchart TD
A[Start Build]
A --> B[Read CMakeLists.txt]
B --> C[Apply Security Compiler Flags]
C --> D[Remove Hardcoded Debug Flags]
D --> E[Propagate Reproducible Build Parameters]
E --> F[Build Artifacts]
F --> G[End]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- Fix the typo in your fortify macro—
_D_FORTITY_SOURCEshould be_D_FORTIFY_SOURCE. - For more precise control, consider using
target_compile_optionson your specific targets instead of globalADD_DEFINITIONS. - To fully support reproducible builds, add handling for
SOURCE_DATE_EPOCH(e.g. via-D SOURCE_DATE_EPOCH) and strip out any__DATE__/__TIME__macros.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Fix the typo in your fortify macro—`_D_FORTITY_SOURCE` should be `_D_FORTIFY_SOURCE`.
- For more precise control, consider using `target_compile_options` on your specific targets instead of global `ADD_DEFINITIONS`.
- To fully support reproducible builds, add handling for `SOURCE_DATE_EPOCH` (e.g. via `-D SOURCE_DATE_EPOCH`) and strip out any `__DATE__`/`__TIME__` macros.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
deepin pr auto review我来分析一下这个diff的修改内容：
分析建议：
# 在CMakeLists.txt中
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -g -Wall")
set(CMAKE_CXX_FLAGS_RELEASE "-O2 -DNDEBUG")
set(CMAKE_CXX_FLAGS_DEBUG "-O0 -g")
# 更全面的安全编译参数
ADD_DEFINITIONS("-fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security -fno-common")# 在debian/rules中
DEB_CMAKE_EXTRA_FLAGS += -DCMAKE_SKIP_BUILD_RPATH=ON
export DEB_CXXFLAGS_MAINT_APPEND = -Wall -Wformat -Wformat-security -fno-common
export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-E -Wl,-pie这些修改将：
|
BLumia
approved these changes
Nov 17, 2025
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: 18202781743, BLumia The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
Enable reproducible and secure builds by removing hardcoded debug flags and introducing reproducible build parameters in CMake and Debian packaging
Build: