rmohr / bazeldnf

Build multi-arch base containers based on RPM with bazel.
Apache License 2.0
30 stars 18 forks source link

rpm2tar produces non-deterministic output #58

Closed malt3 closed 1 year ago

malt3 commented 1 year ago

rpm2tar stores symlinks, capabilities and selinuxLabels in maps: https://github.com/rmohr/bazeldnf/blob/6a9f5247f6fea6aabf9a4538305e1ab6d2a4356a/cmd/rpm2tar.go#L17-L19

This leads to non-deterministic order of tar header generated in the resulting tar file. In particular, the symlinks are traversed in non-deterministic order and tar headers are generated: https://github.com/rmohr/bazeldnf/blob/6a9f5247f6fea6aabf9a4538305e1ab6d2a4356a/cmd/rpm2tar.go#L53

I'm thinking about either using slices to store the symlinks, capabilities and selinuxLabels (while preserving the order given by the flags) or sorting the map keys during traversal. I can provide a fix but would be interested in what is preferred.