[OTHER] Can't reproduce SHA256 hash for tarballs #314

koru commented 2026年06月11日 06:33:50 +02:00

Please explain your inquiry.

How to tarballs:

> git clone --depth=1 git@codeberg.org:celenity/Phoenix.git Phoenix
> cd Phoenix
> git checkout 2026年06月10日.1
> bash +x scripts/get_sources.sh && bash +x scripts/build.sh
> cd outputs/
> sha256sum -- phoenix-2026年06月10日.1-linux.tar.xz
3b9a000ef7a86df9e6b21a6b4d446dd6e25d1ab23c872f5b77a8b92b8a0391b9 phoenix-2026年06月10日.1-linux.tar.xz

Remote:

> wget https://releases.celenity.dev/phoenix/releases/2026.06.10.1/linux/phoenix-2026年06月10日.1-linux.tar.xz
> sha256sum -- phoenix-2026年06月10日.1-linux.tar.xz 
eba5f8073524a07681291adf354c7a59779ff43011f00bafb7de189836558599 phoenix-2026年06月10日.1-linux.tar.xz

How to universal config:

# build...
> cd outputs/universal/
> sha256sum -- phoenix-2026年06月10日.1-universal.cfg 
718099003340f228c115115db765c3e4ed22041debe8732faa7dc4640d514585 phoenix-2026年06月10日.1-universal.cfg

Remote:

> wget https://releases.celenity.dev/phoenix/releases/2026.06.10.1/universal/phoenix-2026年06月10日.1-universal.cfg
> sha256sum -- phoenix-2026年06月10日.1-universal.cfg 
718099003340f228c115115db765c3e4ed22041debe8732faa7dc4640d514585 phoenix-2026年06月10日.1-universal.cfg

Also see: https://codeberg.org/celenity/Phoenix/src/branch/dev/docs/build.md

I think there issue related to archive/tarball compression or am I missing something?

### Please explain your inquiry. How to tarballs: ```bash > git clone --depth=1 git@codeberg.org:celenity/Phoenix.git Phoenix > cd Phoenix > git checkout 2026年06月10日.1 > bash +x scripts/get_sources.sh && bash +x scripts/build.sh > cd outputs/ > sha256sum -- phoenix-2026年06月10日.1-linux.tar.xz 3b9a000ef7a86df9e6b21a6b4d446dd6e25d1ab23c872f5b77a8b92b8a0391b9 phoenix-2026年06月10日.1-linux.tar.xz ``` Remote: ```bash > wget https://releases.celenity.dev/phoenix/releases/2026.06.10.1/linux/phoenix-2026年06月10日.1-linux.tar.xz > sha256sum -- phoenix-2026年06月10日.1-linux.tar.xz eba5f8073524a07681291adf354c7a59779ff43011f00bafb7de189836558599 phoenix-2026年06月10日.1-linux.tar.xz ``` How to universal config: ```bash # build... > cd outputs/universal/ > sha256sum -- phoenix-2026年06月10日.1-universal.cfg 718099003340f228c115115db765c3e4ed22041debe8732faa7dc4640d514585 phoenix-2026年06月10日.1-universal.cfg ``` Remote: ```bash > wget https://releases.celenity.dev/phoenix/releases/2026.06.10.1/universal/phoenix-2026年06月10日.1-universal.cfg > sha256sum -- phoenix-2026年06月10日.1-universal.cfg 718099003340f228c115115db765c3e4ed22041debe8732faa7dc4640d514585 phoenix-2026年06月10日.1-universal.cfg ``` Also see: https://codeberg.org/celenity/Phoenix/src/branch/dev/docs/build.md I think there issue related to archive/tarball compression or am I missing something?

degausser commented 2026年06月11日 09:42:16 +02:00

https://www.gnu.org/software/tar/manual/html_node/Reproducibility.html

Release archives are presumably done using GNU tar on osx, some of the recommended GNU extension flags could be included here. Piping to xz/gzip with specific XZ_FLAGS /GZIP_FLAGS, instead of tar -z / tar -J, might be needed as well.
Or, if GNU tar is not to be presumed, setting the (ancient) --format=ustar instead of pax/posix to skip pax headers altogether, might also be enough.

https://www.gnu.org/software/tar/manual/html_node/Reproducibility.html Release archives are presumably done using [GNU tar on osx](https://codeberg.org/celenity/Phoenix/src/commit/c1a177801e6cb37bf8978a0ec343521cf0c72e44/scripts/env_common.sh#L164-L174), some of the recommended GNU extension flags could be included [here](https://codeberg.org/celenity/Phoenix/src/commit/c1a177801e6cb37bf8978a0ec343521cf0c72e44/scripts/fly.sh#L626). Piping to `xz`/`gzip` with specific `XZ_FLAGS` /`GZIP_FLAGS`, instead of `tar -z` / `tar -J`, might be needed as well. Or, if GNU tar is not to be presumed, setting the (ancient) [`--format=ustar`](https://stackoverflow.com/a/52817819) instead of `pax`/`posix` to skip pax headers altogether, might also be enough.

degausser commented 2026年06月11日 10:09:02 +02:00

https://wiki.debian.org/ReproducibleBuilds/TimestampsInZip

also, for the Windows zip. At least -X/--no-extra should be included here, but that will likely not be enough; all files (*) to be zipped should probably be TZ=C touch-ed recursively to some static timestamp. -o/--latest-time only passed to zip would not help, since git cloned directories will have a different "latest" timestamps local vs. remote.

https://wiki.debian.org/ReproducibleBuilds/TimestampsInZip also, for the Windows zip. At least `-X`/`--no-extra` should be included [here](https://codeberg.org/celenity/Phoenix/src/commit/c1a177801e6cb37bf8978a0ec343521cf0c72e44/scripts/fly.sh#L624), but that will likely not be enough; all files (`*`) to be zipped should probably be `TZ=C touch`-ed recursively to some static timestamp. `-o`/`--latest-time` only passed to `zip` would not help, since `git clone`d directories will have a different "latest" timestamps local vs. remote.

celenity commented 2026年07月07日 07:58:55 +02:00

Thank you for filing this @koru, and thank you for sharing that extremely useful information @degausser!

This should now be fixed - it at least appears to be working/creating matching archives on my system, but please let me know if there's still any issues.

Thank you for filing this @koru, and thank you for sharing that extremely useful information @degausser! This should now be fixed - it at least appears to be working/creating matching archives on my system, but please let me know if there's still any issues.