From 86184b18d22136dcbc1e66e3051618c89d4b01f1 Mon Sep 17 00:00:00 2001 From: Paul Spooren Date: Wed, 10 Jun 2026 16:21:40 +0200 Subject: [PATCH] package: nftables backport of reproducible builds patches Building `nftables` twice results in slightly different binaries and since it's including in the OpenWrt default firmware, breaks reproducibility of shipped artifacts. Enabling autoreconf, since the patches introduce a `nftvbersion.h.in` file. This commit backports patches netfilter to fix this: * https://git.netfilter.org/nftables/commit/?id=ca86f206c92704170a295b8dc7a41f6448835dde * https://git.netfilter.org/nftables/commit/?id=b92571cc59ce49fdd9fe2daac9350529adfb2424 * https://git.netfilter.org/nftables/commit/?id=2a0ec8a7246e5c5eb85270e3d4de43e20a00c577 Fixes: https://github.com/openwrt/openwrt/issues/23709 Link: https://github.com/openwrt/openwrt/pull/23735 Signed-off-by: Paul Spooren --- package/network/utils/nftables/Makefile | 3 +- ...fy-the-instantiation-of-nftversion-h.patch | 78 +++++++++++++++++ ...e-build-time-stamp-once-at-configure.patch | 83 +++++++++++++++++++ ...URCE_DATE_EPOCH-for-build-time-stamp.patch | 33 ++++++++ 4 files changed, 196 insertions(+), 1 deletion(-) create mode 100644 package/network/utils/nftables/patches/001-build-simplify-the-instantiation-of-nftversion-h.patch create mode 100644 package/network/utils/nftables/patches/002-build-generate-build-time-stamp-once-at-configure.patch create mode 100644 package/network/utils/nftables/patches/003-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch diff --git a/package/network/utils/nftables/Makefile b/package/network/utils/nftables/Makefile index 0147c4d0572..ff0d04b6c4f 100644 --- a/package/network/utils/nftables/Makefile +++ b/package/network/utils/nftables/Makefile @@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=nftables PKG_VERSION:=1.1.6 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files @@ -18,6 +18,7 @@ PKG_LICENSE:=GPL-2.0 PKG_LICENSE_FILES:=COPYING PKG_INSTALL:=1 +PKG_FIXUP:=autoreconf PKG_BUILD_FLAGS:=lto diff --git a/package/network/utils/nftables/patches/001-build-simplify-the-instantiation-of-nftversion-h.patch b/package/network/utils/nftables/patches/001-build-simplify-the-instantiation-of-nftversion-h.patch new file mode 100644 index 00000000000..64ca9b228d9 --- /dev/null +++ b/package/network/utils/nftables/patches/001-build-simplify-the-instantiation-of-nftversion-h.patch @@ -0,0 +1,78 @@ +From 2a0ec8a7246e5c5eb85270e3d4de43e20a00c577 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Wed, 28 Jan 2026 18:31:05 +0000 +Subject: [PATCH] build: simplify the instantation of nftversion.h + +Add an nftversion.h.in autoconf input file which configure uses to instantiate +nftversion.h in the usual way. + +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + configure.ac | 19 +++---------------- + nftversion.h.in | 19 +++++++++++++++++++ + 2 files changed, 22 insertions(+), 16 deletions(-) + create mode 100644 nftversion.h.in + +diff --git a/configure.ac b/configure.ac +index 6825474..2c61072 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -147,22 +147,8 @@ AM_CONDITIONAL([BUILD_SERVICE], [test "x$unitdir" != x]) + AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release], + [Stable release number])], + [], [with_stable_release=0]) +-AC_CONFIG_COMMANDS([stable_release], +- [STABLE_RELEASE=$stable_release], +- [stable_release=$with_stable_release]) +-AC_CONFIG_COMMANDS([nftversion.h], [ +-( +- echo "static char nftversion[[]] = {" +- echo " ${VERSION}," | tr '.' ',' +- echo " ${STABLE_RELEASE}" +- echo "};" +- echo "static char nftbuildstamp[[]] = {" +- for ((i = 56; i >= 0; i-= 8)); do +- echo " ((uint64_t)MAKE_STAMP >> $i) & 0xff," +- done +- echo "};" +-) >nftversion.h +-]) ++AC_SUBST([STABLE_RELEASE],[$with_stable_release]) ++AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')]) + # Current date should be fetched exactly once per build, + # so have 'make' call date and pass the value to every 'gcc' call + AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"]) +@@ -175,6 +161,7 @@ AM_CONDITIONAL([BUILD_DISTCHECK], [test "x$enable_distcheck" = "xyes"]) + AC_CONFIG_FILES([ \ + Makefile \ + libnftables.pc \ ++ nftversion.h \ + ]) + AC_OUTPUT + +diff --git a/nftversion.h.in b/nftversion.h.in +new file mode 100644 +index 0000000..6f89771 +--- /dev/null ++++ b/nftversion.h.in +@@ -0,0 +1,19 @@ ++#ifndef NFTABLES_NFTVERSION_H ++#define NFTABLES_NFTVERSION_H ++ ++static char nftversion[] = { ++ @NFT_VERSION@, ++ @STABLE_RELEASE@ ++}; ++static char nftbuildstamp[] = { ++ ((uint64_t)MAKE_STAMP >> 56) & 0xff, ++ ((uint64_t)MAKE_STAMP >> 48) & 0xff, ++ ((uint64_t)MAKE_STAMP >> 40) & 0xff, ++ ((uint64_t)MAKE_STAMP >> 32) & 0xff, ++ ((uint64_t)MAKE_STAMP >> 24) & 0xff, ++ ((uint64_t)MAKE_STAMP >> 16) & 0xff, ++ ((uint64_t)MAKE_STAMP >> 8) & 0xff, ++ ((uint64_t)MAKE_STAMP >> 0) & 0xff, ++}; ++ ++#endif /* !defined(NFTABLES_NFTVERSION_H) */ diff --git a/package/network/utils/nftables/patches/002-build-generate-build-time-stamp-once-at-configure.patch b/package/network/utils/nftables/patches/002-build-generate-build-time-stamp-once-at-configure.patch new file mode 100644 index 00000000000..eae6a5bc073 --- /dev/null +++ b/package/network/utils/nftables/patches/002-build-generate-build-time-stamp-once-at-configure.patch @@ -0,0 +1,83 @@ +From b92571cc59ce49fdd9fe2daac9350529adfb2424 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Wed, 28 Jan 2026 18:31:06 +0000 +Subject: [PATCH] build: generate build time-stamp once at configure + +The existing implementation tries to generate a time-stamp once when make is +run. However, it doesn't work and generates one for every compilation. Getting +this right portably in automake is not straightforward. Instead, do it when +configure is run. + +Rename the time-stamp variable since it is no longer generated by make. + +Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + Makefile.am | 2 -- + configure.ac | 4 +--- + nftversion.h.in | 18 ++++++++++-------- + 3 files changed, 11 insertions(+), 13 deletions(-) + +diff --git a/Makefile.am b/Makefile.am +index b134330..ceb2225 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -159,8 +159,6 @@ AM_CFLAGS = \ + \ + $(GCC_FVISIBILITY_HIDDEN) \ + \ +- -DMAKE_STAMP=$(MAKE_STAMP) \ +- \ + $(NULL) + + AM_YFLAGS = -d -Wno-yacc +diff --git a/configure.ac b/configure.ac +index 2c61072..9859072 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -149,9 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release], + [], [with_stable_release=0]) + AC_SUBST([STABLE_RELEASE],[$with_stable_release]) + AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')]) +-# Current date should be fetched exactly once per build, +-# so have 'make' call date and pass the value to every 'gcc' call +-AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"]) ++AC_SUBST([BUILD_STAMP], [$(date +%s)]) + + AC_ARG_ENABLE([distcheck], + AS_HELP_STRING([--enable-distcheck], [Build for distcheck]), +diff --git a/nftversion.h.in b/nftversion.h.in +index 6f89771..325b9dc 100644 +--- a/nftversion.h.in ++++ b/nftversion.h.in +@@ -1,19 +1,21 @@ + #ifndef NFTABLES_NFTVERSION_H + #define NFTABLES_NFTVERSION_H + ++#define BUILD_STAMP @BUILD_STAMP@ ++ + static char nftversion[] = { + @NFT_VERSION@, + @STABLE_RELEASE@ + }; + static char nftbuildstamp[] = { +- ((uint64_t)MAKE_STAMP >> 56) & 0xff, +- ((uint64_t)MAKE_STAMP >> 48) & 0xff, +- ((uint64_t)MAKE_STAMP >> 40) & 0xff, +- ((uint64_t)MAKE_STAMP >> 32) & 0xff, +- ((uint64_t)MAKE_STAMP >> 24) & 0xff, +- ((uint64_t)MAKE_STAMP >> 16) & 0xff, +- ((uint64_t)MAKE_STAMP >> 8) & 0xff, +- ((uint64_t)MAKE_STAMP >> 0) & 0xff, ++ ((uint64_t)BUILD_STAMP >> 56) & 0xff, ++ ((uint64_t)BUILD_STAMP >> 48) & 0xff, ++ ((uint64_t)BUILD_STAMP >> 40) & 0xff, ++ ((uint64_t)BUILD_STAMP >> 32) & 0xff, ++ ((uint64_t)BUILD_STAMP >> 24) & 0xff, ++ ((uint64_t)BUILD_STAMP >> 16) & 0xff, ++ ((uint64_t)BUILD_STAMP >> 8) & 0xff, ++ ((uint64_t)BUILD_STAMP >> 0) & 0xff, + }; + + #endif /* !defined(NFTABLES_NFTVERSION_H) */ diff --git a/package/network/utils/nftables/patches/003-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch b/package/network/utils/nftables/patches/003-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch new file mode 100644 index 00000000000..c37c77b7d24 --- /dev/null +++ b/package/network/utils/nftables/patches/003-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch @@ -0,0 +1,33 @@ +From ca86f206c92704170a295b8dc7a41f6448835dde Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Wed, 28 Jan 2026 18:31:07 +0000 +Subject: [PATCH] build: support `SOURCE_DATE_EPOCH` for build time-stamp + +In order to support reproducible builds, set the build time-stamp to the value +of the environment variable, `SOURCE_DATE_EPOCH`, if set, and fall back to +calling `date`, otherwise. + +Link: https://reproducible-builds.org/docs/source-date-epoch/ +Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata") +Reported-by: Arnout Engelen +Closes: https://github.com/NixOS/nixpkgs/issues/478048 +Suggested-by: Philipp Bartsch +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + configure.ac | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/configure.ac b/configure.ac +index 9859072..0226086 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -149,7 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release], + [], [with_stable_release=0]) + AC_SUBST([STABLE_RELEASE],[$with_stable_release]) + AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')]) +-AC_SUBST([BUILD_STAMP], [$(date +%s)]) ++AC_SUBST([BUILD_STAMP], [${SOURCE_DATE_EPOCH:-$(date +%s)}]) + + AC_ARG_ENABLE([distcheck], + AS_HELP_STRING([--enable-distcheck], [Build for distcheck]), -- 2.47.3