depends: Make tarball creation from local directory reproducible #35618

hebasto commented at 1:56 PM on June 29, 2026: member

This guarantees $(package)_sha256_hash reproducibility regardless of the default behavior of $(build_TAR) and fixes caching for the native_libmultiprocess package.

Steps to reproduce the issue using the master branch @ 2a9e35d293b308e81811fa93ad2e5e8ed20e66e0:

$ mkdir a && cd a && git init
$ git remote add origin https://github.com/bitcoin/bitcoin.git
$ git fetch --depth 1 origin 2a9e35d293b308e81811fa93ad2e5e8ed20e66e0
$ git checkout FETCH_HEAD
$ cd depends
$ gmake print-native_libmultiprocess_sha256_hash  # Hash A. Compare with Hash B.
native_libmultiprocess_sha256_hash=7dd817bfc0ee23c408299907aff13fefb0bd3a54ec66dc14ea15b0cc38c3d9ce
$ cd ../../ && sleep 2
$ mkdir b && cd b && git init
$ git remote add origin https://github.com/bitcoin/bitcoin.git
$ git fetch --depth 1 origin 2a9e35d293b308e81811fa93ad2e5e8ed20e66e0
$ git checkout FETCH_HEAD
$ cd depends
$ gmake print-native_libmultiprocess_sha256_hash  # Hash B. Compare with Hash A.
native_libmultiprocess_sha256_hash=34d6f79560c0ff7a4f46bd6bfb4693076546b41f071b6dbf879da45ac8384688

depends: Make tarball creation from local directory reproducible

This guarantees `$(package)_sha256_hash` reproducibility regardless of
the default behavior of `$(build_TAR)`. Fixes caching on some systems,
for example, on FreeBSD.

7e973cce52

hebasto added the label Build system on Jun 29, 2026

DrahtBot commented at 1:56 PM on June 29, 2026: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35618.

Reviews

See the guideline and AI policy for information on the review process.

Type	Reviewers
ACK	willcl-ark, fanquake

If your review is incorrectly listed, please copy-paste <code></code> into the comment that the bot should ignore.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#35765 (depends: hash local source contents by willcl-ark)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

fanquake commented at 1:58 PM on June 29, 2026: member

Fixes caching on some systems, for example, on FreeBSD.

What is the underlying issue? Why does this only effect FreeBSD?

hebasto commented at 2:32 PM on June 29, 2026: member

Fixes caching on some systems, for example, on FreeBSD.

What is the underlying issue?

It likely depends on how tar interacts with the underlying filesystem. While I can't point to the specific code in the related system utilities, we have this code for the exact same reason::https://github.com/bitcoin/bitcoin/blob/57b3bf8496032cb7a87eafe94ce840387ece2408/depends/funcs.mk#L284-L288

Why does this only effect FreeBSD?

It's not FreeBSD-specific. I've just tested on macOS Tahoe, and the same issue occurred. It was simply noticed on FreeBSD first in https://github.com/hebasto/bitcoin-core-nightly.

hebasto commented at 5:09 PM on June 29, 2026: member

My Guix build:

aarch64
014feb68bb9779bb1e5c5e6de28cf90a4d4327a4e45703825a4e67b3e9ced3fc  guix-build-7e973cce52ca/output/aarch64-linux-gnu/SHA256SUMS.part
2fed3f1d4f1c9db637ba43077ced808f8ca83c87a51ac3833cc41de7866cbb48  guix-build-7e973cce52ca/output/aarch64-linux-gnu/bitcoin-7e973cce52ca-aarch64-linux-gnu-debug.tar.gz
22b485e1b175536b093c82061019cfafc845e725f8790a13deebd3fd7a254cef  guix-build-7e973cce52ca/output/aarch64-linux-gnu/bitcoin-7e973cce52ca-aarch64-linux-gnu.tar.gz
0fa4c6e76d806526d7c3c1f15b064067111eb6f43d34f9437c5fcc84e437d8fa  guix-build-7e973cce52ca/output/arm-linux-gnueabihf/SHA256SUMS.part
51d7ad7634dda8758f36d1ff8bb52dea25fd8116f9d3a65ce92150dbea018fa6  guix-build-7e973cce52ca/output/arm-linux-gnueabihf/bitcoin-7e973cce52ca-arm-linux-gnueabihf-debug.tar.gz
ff728785c3ee3fb456918388029d98bb8978edf145bff3e1067ea78f09c05cb5  guix-build-7e973cce52ca/output/arm-linux-gnueabihf/bitcoin-7e973cce52ca-arm-linux-gnueabihf.tar.gz
7b4af6358c33f4ced24fd58efb115a8fffd3ca8d657d0a01438aa8c19915bdc7  guix-build-7e973cce52ca/output/arm64-apple-darwin/SHA256SUMS.part
223256c467f76238b784cada28901258326efe974cbc90a25c18d6153afbcef2  guix-build-7e973cce52ca/output/arm64-apple-darwin/bitcoin-7e973cce52ca-arm64-apple-darwin-codesigning.tar.gz
227b13a7706de3b9e614b9936c707db55406906b8417c16e4e5fdde3fb9dc12b  guix-build-7e973cce52ca/output/arm64-apple-darwin/bitcoin-7e973cce52ca-arm64-apple-darwin-unsigned.tar.gz
8d683d84513b96b8fa38a6330ea4dc3eedf5c4902984172704613b8e5be50ea2  guix-build-7e973cce52ca/output/arm64-apple-darwin/bitcoin-7e973cce52ca-arm64-apple-darwin-unsigned.zip
e311d6fa8938ad9932d3c1e3d54742a811a30f68c243996b99d75ebc8064ade9  guix-build-7e973cce52ca/output/dist-archive/bitcoin-7e973cce52ca.tar.gz
876d44709819c76cd222b87e5add833b711db553445367b70d5d7de11d81b97b  guix-build-7e973cce52ca/output/powerpc64-linux-gnu/SHA256SUMS.part
2d9d08f4233f0398a76b9f6566e555d78c9703bcb8529309e5840e68e3d586c4  guix-build-7e973cce52ca/output/powerpc64-linux-gnu/bitcoin-7e973cce52ca-powerpc64-linux-gnu-debug.tar.gz
3751f45b851d6bc1214b0e258dc42f4f7ebf9e88250611c5f8eb2d9aaf0bfb12  guix-build-7e973cce52ca/output/powerpc64-linux-gnu/bitcoin-7e973cce52ca-powerpc64-linux-gnu.tar.gz
021f6a27ab5c2becc3e43f8bad31a5dffbf7ee7949f56d47b3fe3a1c2d3e50ac  guix-build-7e973cce52ca/output/riscv64-linux-gnu/SHA256SUMS.part
d8e8d18a1a99c8d8fb880911ece46d5bbbbea12e080e3c61d8e1f28a226e0add  guix-build-7e973cce52ca/output/riscv64-linux-gnu/bitcoin-7e973cce52ca-riscv64-linux-gnu-debug.tar.gz
eaffdf953f1c8ec7dbf23ac48c7f39fd7576efa605d2b0f72681afc620921597  guix-build-7e973cce52ca/output/riscv64-linux-gnu/bitcoin-7e973cce52ca-riscv64-linux-gnu.tar.gz
58d5cfcdb5ee926c0f8435414ca16871f0c1dc5f4cd402c72b463f3cee009c26  guix-build-7e973cce52ca/output/x86_64-apple-darwin/SHA256SUMS.part
1653d0299d9e34cc3e99c67362c0d1c1636b9dd7dd267476d4855100c8bdc549  guix-build-7e973cce52ca/output/x86_64-apple-darwin/bitcoin-7e973cce52ca-x86_64-apple-darwin-codesigning.tar.gz
26de287dc0526ce50d6c09bf00d1250620d4f57e17a42924524dcb749835412a  guix-build-7e973cce52ca/output/x86_64-apple-darwin/bitcoin-7e973cce52ca-x86_64-apple-darwin-unsigned.tar.gz
43eeb1017537ceca727a34404eb79f283a000d71b578789eec5169b37d468373  guix-build-7e973cce52ca/output/x86_64-apple-darwin/bitcoin-7e973cce52ca-x86_64-apple-darwin-unsigned.zip
c56db31ca4da6fe9c4c9e334bc501b23c57ee9ff7127a23dc42f71c049ddfda3  guix-build-7e973cce52ca/output/x86_64-linux-gnu/SHA256SUMS.part
5c3cb69cb5b7559ec453dfa6e4b7fd753ab7550cf36f37cd70e9066aa0ebbc1e  guix-build-7e973cce52ca/output/x86_64-linux-gnu/bitcoin-7e973cce52ca-x86_64-linux-gnu-debug.tar.gz
9a97c81e4487fb96a9bf7196e0dca6781698d431aecaf4d93bf9617e113d05dd  guix-build-7e973cce52ca/output/x86_64-linux-gnu/bitcoin-7e973cce52ca-x86_64-linux-gnu.tar.gz
a764f714e90bbba6deeea5876151d0567f08f20db65afcea17dd9e01835f0639  guix-build-7e973cce52ca/output/x86_64-w64-mingw32/SHA256SUMS.part
e574bfd982913b333e6b950e9b95bb42828d6f12276f92c72933e9d1c87bddc4  guix-build-7e973cce52ca/output/x86_64-w64-mingw32/bitcoin-7e973cce52ca-win64-codesigning.tar.gz
1c0cd61e445831af7c399045ada19123fd20bdb8ecd66dd626514fd4141ddb72  guix-build-7e973cce52ca/output/x86_64-w64-mingw32/bitcoin-7e973cce52ca-win64-debug.zip
57a605e1759aea234f7de930e3ccc590b8dcdda136d2d0e198fdcbe1037d2ce3  guix-build-7e973cce52ca/output/x86_64-w64-mingw32/bitcoin-7e973cce52ca-win64-setup-unsigned.exe
5240a286dfe91e2dc9d04b4b253b7cf62e14edc585a0d57d4e9588968ab10475  guix-build-7e973cce52ca/output/x86_64-w64-mingw32/bitcoin-7e973cce52ca-win64-unsigned.zip

hebasto commented at 5:12 PM on June 29, 2026: member

Friendly ping @ryanofsky as the original code author :)

in depends/funcs.mk:53 in 7e973cce52

  46 | @@ -47,7 +47,11 @@ endef
  47 |  define fetch_local_dir_sha256
  48 |      if ! [ -f $($(1)_source) ] || [ -n "$$(find $($(1)_local_dir) -newer $($(1)_source) | head -n1)" ]; then \
  49 |          mkdir -p $(dir $($(1)_source)) && \
  50 | -        $(build_TAR) -c -f $($(1)_source) -C $($(1)_local_dir) . && \
  51 | +        ( \
  52 | +          cd $($(1)_local_dir) && \
  53 | +          find . -print0 | TZ=UTC xargs -0r $(build_TOUCH) && \
  54 | +          find . | LC_ALL=C sort | $(build_TAR) --no-recursion -c -f $($(1)_source) -T - \

vicjuma commented at 12:40 PM on July 3, 2026:

utACK. Replacing implicit tar traversal with explicit ordering and mtime normalization appears correct. Guess it is a tooling issue IMO cause tar might probably behave differently in OpenBSD/MacOS as opposed to Debian/Ubuntu. Though from depends/README.md gtar (GNU tar) is recommended. This PR decouples the archiving process from tar implementation differences across operating systems.

vicjuma commented at 12:44 PM on July 3, 2026: contributor

@fanquake I guess it might be linked to how the archiving process happens in different operating systems

willcl-ark approved

willcl-ark commented at 10:53 AM on August 19, 2026: member

ACK 7e973cce52caeadaa9dcd4b5b6b7f53372e0aa0e

This prevents rebuilding on native-libmultiprocess on x64 in CI runs from #36006, so this is apparently not only scoped to *BSDs and MacOS.

I would still like in the future to address stale caches with something more comprehensive like #35765, but this is a neatly-scoped fix to the reproducibility.

The only thing I see of note is that find . -print0 | TZ=UTC xargs -0r $(build_TOUCH) touches local files which is new behaviour, but I don't think we have any other tools which rely on mtime which might be put out by this? We already do this with staging archives too IIRC, so doesn't seem like an issue to also do it to $(package)_local_dir

fanquake commented at 12:37 PM on August 19, 2026: member

so this is apparently not only scoped to *BSDs and MacOS.

Seems like at least the PR description needs updating / and the root cause could be a bit clearer, because if this is fixing issues on Linux, it seems like this problem should be showing up more often?

hebasto commented at 12:59 PM on August 19, 2026: member

so this is apparently not only scoped to *BSDs and MacOS.

Seems like at least the PR description needs updating / and the root cause could be a bit clearer, because if this is fixing issues on Linux, it seems like this problem should be showing up more often?

Indeed. The issue is reproducible on Linux as well (including my Fedora 44).

The PR description has been updated.

fanquake commented at 4:07 PM on August 25, 2026: member

ACK 7e973cce52caeadaa9dcd4b5b6b7f53372e0aa0e

fanquake merged this on Aug 25, 2026

fanquake closed this on Aug 25, 2026

hebasto deleted the branch on Aug 25, 2026