build_microcode_initrd: Normalize timestamps for reproducible builds

When building the microcode initrd, files are created in a temporary
directory with current timestamps. These timestamps are then embedded
in the CPIO archive, causing non-reproducible builds even when
SourceDateEpoch is set.

Fix this by normalizing the modification times of all files in the
microcode root directory to source_date_epoch before creating the
CPIO archive.

Signed-off-by: Robert Sturla <rsturla@redhat.com>

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index ac6705e7fec3a0632793a713dedf2807eacf9fa5..976fb399e918acd616dd102bd79c0686d6c32408 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -1500,6 +1500,9 @@ def build_microcode_initrd(context: Context) -> list[Path]:
                     for p in intel.iterdir():
                         f.write(p.read_bytes())
 
+        # Normalize timestamps for reproducible builds before creating cpio
+        normalize_mtime(root, context.config.source_date_epoch)
+
         make_cpio(root, microcode, sandbox=context.sandbox)
 
     return [microcode]