-
Notifications
You must be signed in to change notification settings - Fork 264
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Make tar2ext4 deterministic with files without parent dir in tar #2270
Make tar2ext4 deterministic with files without parent dir in tar #2270
Conversation
Signed-off-by: Takuro Sato <[email protected]>
6d01bd3
to
d43c1e8
Compare
Signed-off-by: Takuro Sato <[email protected]>
Signed-off-by: Takuro Sato <[email protected]>
@anmaxvl You might have already checked it, but as I mentioned in the PR description the tests under |
ext4/tar2ext4/tar2ext4_test.go
Outdated
|
||
opts := []Option{ConvertWhiteout} | ||
|
||
tmpVhdPath := filepath.Join(os.TempDir(), "test-vhd.ext4") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minor nit: its not a VHD, since there is no VHD footer option
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed in 6dee921
Signed-off-by: Takuro Sato <[email protected]>
…rosoft#2270) Make tar2ext4 deterministic with files without parent dir in tar Signed-off-by: Takuro Sato <[email protected]> Signed-off-by: Heather Garvison <[email protected]>
Problem to fix
./dmverity-vhd roothash
is not deterministic for some file docker images.The above command shows a diff which suggest it's not deterministic.
This is causing a problem for
az confcom
tool that the generated security policy is not consistent for each run (./dmverity-vhd roothash
is called here).Container deployment is blocked as well for C-ACI.
Cause of the problem
In the example image, there is a problematic tar file only with a file
etc/nsswitch.conf
. For most of tar files there would be alsoetc/
directory as the parent ofnsswitch.conf
, but for this specific tar there isn't.For the such files without parent,
MakeParents()
makes the parent directories for ext4, but it usestime.Now()
and it's causing the non-deterministic behavior.Fix
Change
time.Now()
to the child's value.Test
diff bad-debian-1.txt bad-debian-2.txt
doesn't show any diff after the fixgo test ./ext4/tar2ext4/...
. It includes new a unit test case.Note
go test ./ext4/internal/compactext4/...
is broken, but it seems to be the case even for main branch. Does anyone now the problem?