From 40a48acc89b3a4a58d1f8e16628cfe7dd74dc5d5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:56:43 +0000 Subject: [PATCH 1/3] Add pexip_reproducible_build.patch for deterministic builds Resolves OPENSSLDIR, ENGINESDIR and MODULESDIR at configure time instead of make time, and strips -I include paths from the compiler_flags string recorded in buildinf.h. Co-authored-by: tbeloqui <1252418+tbeloqui@users.noreply.github.com> --- debian/patches/pexip_reproducible_build.patch | 45 +++++++++++++++++++ debian/patches/series | 3 +- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 debian/patches/pexip_reproducible_build.patch diff --git a/debian/patches/pexip_reproducible_build.patch b/debian/patches/pexip_reproducible_build.patch new file mode 100644 index 0000000000..f5ff34860f --- /dev/null +++ b/debian/patches/pexip_reproducible_build.patch @@ -0,0 +1,45 @@ +Description: Ensure reproducible builds by evaluating directory paths at configure time + OPENSSLDIR, ENGINESDIR and MODULESDIR are passed to the compiler as -D flags + referencing Make variables (e.g. $(OPENSSLDIR)). These Make variables can + potentially be overridden at build time, breaking reproducibility. Fix this by + resolving the paths at configure time using the Perl variables that are already + available, embedding fixed literal strings in the generated Makefile. +Author: Pexip AS +Forwarded: not-needed +Last-Update: 2026-08-06 + +--- a/Configurations/unix-Makefile.tmpl ++++ b/Configurations/unix-Makefile.tmpl +@@ -449,10 +449,15 @@ + @{$config{lib_cppflags}}, + @{$config{shared_cppflag}}); + join(' ', $lib_cppflags, +- (map { '-D'.$_ } +- 'OPENSSLDIR="\"$(OPENSSLDIR)\""', +- 'ENGINESDIR="\"$(ENGINESDIR)\""', +- 'MODULESDIR="\"$(MODULESDIR)\""'), ++ (map { '-D'.$_ } do { ++ use File::Spec::Functions; ++ my $resolved_libdir = file_name_is_absolute($libdir) ++ ? $libdir : catdir($prefix, $libdir); ++ my $engdir = $config{enginesdir} || catdir($resolved_libdir, "engines-$sover_dirname"); ++ my $moddir = $config{modulesdir} || catdir($resolved_libdir, "ossl-modules"); ++ ("OPENSSLDIR=\"\\\"$openssldir\\\"\"", ++ "ENGINESDIR=\"\\\"$engdir\\\"\"", ++ "MODULESDIR=\"\\\"$moddir\\\"\"") }), + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} + LIB_CFLAGS={- join(' ', $target{lib_cflags} || (), + $target{shared_cflag} || (), +--- a/util/mkbuildinf.pl ++++ b/util/mkbuildinf.pl +@@ -13,6 +13,10 @@ + my $platform = pop @ARGV; + my $cflags = join(' ', @ARGV); + $cflags =~ s(\\)(\\\\)g; ++ ++# Strip include paths and directory defines that may contain build-tree paths ++$cflags =~ s/\s*-I\S+//g; ++ + $cflags = "compiler: $cflags"; + + # Use the value of the envvar SOURCE_DATE_EPOCH, even if it's diff --git a/debian/patches/series b/debian/patches/series index 04ebd66d3d..a67020abb0 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -17,4 +17,5 @@ evp-q-mac-nokey.patch pexip_android_fix.patch pexip_ec_point_backport.patch util-copy-skip-missing.patch -pexip_windows_pc_file.patch \ No newline at end of file +pexip_windows_pc_file.patch +pexip_reproducible_build.patch From 13f170acd621be0931fc48b6fc8cb883d63843e8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:31:25 +0000 Subject: [PATCH 2/3] Update pexip_reproducible_build.patch to conditionally clear directory paths When OPENSSL_CLEAR_DIRINFO=1 is set during ./Configure, OPENSSLDIR, ENGINESDIR and MODULESDIR are set to empty strings in the binary. The flag is exported in debian/rules to enable this by default. Co-authored-by: tbeloqui <1252418+tbeloqui@users.noreply.github.com> --- debian/patches/pexip_reproducible_build.patch | 42 ++++++++++++------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/debian/patches/pexip_reproducible_build.patch b/debian/patches/pexip_reproducible_build.patch index f5ff34860f..5a5b03cd1e 100644 --- a/debian/patches/pexip_reproducible_build.patch +++ b/debian/patches/pexip_reproducible_build.patch @@ -1,16 +1,16 @@ -Description: Ensure reproducible builds by evaluating directory paths at configure time - OPENSSLDIR, ENGINESDIR and MODULESDIR are passed to the compiler as -D flags - referencing Make variables (e.g. $(OPENSSLDIR)). These Make variables can - potentially be overridden at build time, breaking reproducibility. Fix this by - resolving the paths at configure time using the Perl variables that are already - available, embedding fixed literal strings in the generated Makefile. +Description: Allow clearing OPENSSLDIR/ENGINESDIR/MODULESDIR from final binary + When building with OPENSSL_CLEAR_DIRINFO=1, the directory path defines + (OPENSSLDIR, ENGINESDIR, MODULESDIR) are set to empty strings, preventing + build-time path information from being embedded in the final binary. + Additionally, -I include paths are stripped from the recorded compiler flags + in buildinf.h. Author: Pexip AS Forwarded: not-needed Last-Update: 2026-08-06 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl -@@ -449,10 +449,15 @@ +@@ -449,10 +449,14 @@ @{$config{lib_cppflags}}, @{$config{shared_cppflag}}); join(' ', $lib_cppflags, @@ -19,14 +19,13 @@ Last-Update: 2026-08-06 - 'ENGINESDIR="\"$(ENGINESDIR)\""', - 'MODULESDIR="\"$(MODULESDIR)\""'), + (map { '-D'.$_ } do { -+ use File::Spec::Functions; -+ my $resolved_libdir = file_name_is_absolute($libdir) -+ ? $libdir : catdir($prefix, $libdir); -+ my $engdir = $config{enginesdir} || catdir($resolved_libdir, "engines-$sover_dirname"); -+ my $moddir = $config{modulesdir} || catdir($resolved_libdir, "ossl-modules"); -+ ("OPENSSLDIR=\"\\\"$openssldir\\\"\"", -+ "ENGINESDIR=\"\\\"$engdir\\\"\"", -+ "MODULESDIR=\"\\\"$moddir\\\"\"") }), ++ my $clear = $ENV{OPENSSL_CLEAR_DIRINFO}; ++ my $odir = $clear ? "" : '$(OPENSSLDIR)'; ++ my $edir = $clear ? "" : '$(ENGINESDIR)'; ++ my $mdir = $clear ? "" : '$(MODULESDIR)'; ++ ("OPENSSLDIR=\"\\\"$odir\\\"\"", ++ "ENGINESDIR=\"\\\"$edir\\\"\"", ++ "MODULESDIR=\"\\\"$mdir\\\"\"") }), '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} LIB_CFLAGS={- join(' ', $target{lib_cflags} || (), $target{shared_cflag} || (), @@ -37,9 +36,20 @@ Last-Update: 2026-08-06 my $cflags = join(' ', @ARGV); $cflags =~ s(\\)(\\\\)g; + -+# Strip include paths and directory defines that may contain build-tree paths ++# Strip include paths that may contain build-tree paths +$cflags =~ s/\s*-I\S+//g; + $cflags = "compiler: $cflags"; # Use the value of the envvar SOURCE_DATE_EPOCH, even if it's +--- a/debian/rules ++++ b/debian/rules +@@ -53,6 +53,8 @@ + %: + dh $@ --without autoreconf + ++export OPENSSL_CLEAR_DIRINFO=1 ++ + override_dh_auto_configure: + tar xf debian/binary.tar + test -z "$(OPTS)" || for opt in $(OPTS); \ From 9ac572398145f859dee7ae595b08a94a2cda4b8c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 10 Aug 2026 09:21:07 +0000 Subject: [PATCH 3/3] Strip -ffile-prefix-map/-fdebug-prefix-map/-fmacro-prefix-map flags from buildinf.h Co-authored-by: tbeloqui <1252418+tbeloqui@users.noreply.github.com> --- debian/patches/pexip_reproducible_build.patch | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/debian/patches/pexip_reproducible_build.patch b/debian/patches/pexip_reproducible_build.patch index 5a5b03cd1e..6f89be008a 100644 --- a/debian/patches/pexip_reproducible_build.patch +++ b/debian/patches/pexip_reproducible_build.patch @@ -2,8 +2,9 @@ Description: Allow clearing OPENSSLDIR/ENGINESDIR/MODULESDIR from final binary When building with OPENSSL_CLEAR_DIRINFO=1, the directory path defines (OPENSSLDIR, ENGINESDIR, MODULESDIR) are set to empty strings, preventing build-time path information from being embedded in the final binary. - Additionally, -I include paths are stripped from the recorded compiler flags - in buildinf.h. + Additionally, -I include paths and non-deterministic compiler flags + (-ffile-prefix-map, -fdebug-prefix-map, -fmacro-prefix-map) are stripped + from the recorded compiler flags in buildinf.h. Author: Pexip AS Forwarded: not-needed Last-Update: 2026-08-06 @@ -31,13 +32,14 @@ Last-Update: 2026-08-06 $target{shared_cflag} || (), --- a/util/mkbuildinf.pl +++ b/util/mkbuildinf.pl -@@ -13,6 +13,10 @@ +@@ -13,6 +13,11 @@ my $platform = pop @ARGV; my $cflags = join(' ', @ARGV); $cflags =~ s(\\)(\\\\)g; + -+# Strip include paths that may contain build-tree paths ++# Strip include paths and non-deterministic prefix-map flags +$cflags =~ s/\s*-I\S+//g; ++$cflags =~ s/\s*-f(?:file|debug|macro)-prefix-map=\S+//g; + $cflags = "compiler: $cflags";