234 lines
6.2 KiB
Bash
234 lines
6.2 KiB
Bash
#!/bin/bash
|
|
# Debian Reproducible Build Script
|
|
# Builds packages with deterministic settings for fingerprint generation
|
|
#
|
|
# Usage: build.sh [build|diff] <package> <version> [patch_url...]
|
|
|
|
set -euo pipefail
|
|
|
|
COMMAND="${1:-help}"
|
|
PACKAGE="${2:-}"
|
|
VERSION="${3:-}"
|
|
OUTPUT_DIR="${OUTPUT_DIR:-/output}"
|
|
|
|
log() {
|
|
echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" >&2
|
|
}
|
|
|
|
show_help() {
|
|
cat <<EOF
|
|
Debian Reproducible Builder
|
|
|
|
Usage:
|
|
build.sh build <package> <version> [patch_urls...]
|
|
Build a package with reproducible settings
|
|
|
|
build.sh diff <package> <vuln_version> <patched_version>
|
|
Build two versions and compute fingerprint diff
|
|
|
|
build.sh --help
|
|
Show this help message
|
|
|
|
Environment:
|
|
SOURCE_DATE_EPOCH Override timestamp (extracted from changelog if not set)
|
|
OUTPUT_DIR Output directory (default: /output)
|
|
DEB_BUILD_OPTIONS Additional build options
|
|
|
|
Examples:
|
|
build.sh build openssl 3.0.7-1
|
|
build.sh diff curl 8.1.0-1 8.1.0-2
|
|
EOF
|
|
}
|
|
|
|
setup_reproducible_env() {
|
|
local pkg="$1"
|
|
|
|
# Reproducible build flags
|
|
export DEB_BUILD_OPTIONS="${DEB_BUILD_OPTIONS:-} reproducible=+all"
|
|
export SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(date +%s)}"
|
|
|
|
# Compiler flags for reproducibility
|
|
export CFLAGS="${CFLAGS:-} -fno-record-gcc-switches -fdebug-prefix-map=$(pwd)=/build"
|
|
export CXXFLAGS="${CXXFLAGS:-} ${CFLAGS}"
|
|
|
|
export LC_ALL=C.UTF-8
|
|
export TZ=UTC
|
|
|
|
log "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
|
|
}
|
|
|
|
fetch_source() {
|
|
local pkg="$1"
|
|
local ver="$2"
|
|
|
|
log "Fetching source for $pkg=$ver"
|
|
|
|
mkdir -p /build/src
|
|
cd /build/src
|
|
|
|
# Enable source repositories
|
|
sudo sed -i 's/^# deb-src/deb-src/' /etc/apt/sources.list.d/*.sources 2>/dev/null || \
|
|
sudo sed -i 's/^# deb-src/deb-src/' /etc/apt/sources.list 2>/dev/null || true
|
|
sudo apt-get update
|
|
|
|
# Fetch source
|
|
if [ -n "$ver" ]; then
|
|
apt-get source "${pkg}=${ver}" || apt-get source "$pkg"
|
|
else
|
|
apt-get source "$pkg"
|
|
fi
|
|
|
|
# Find extracted directory
|
|
local src_dir=$(ls -d "${pkg}"*/ 2>/dev/null | head -1)
|
|
if [ -z "$src_dir" ]; then
|
|
log "ERROR: Could not find source directory for $pkg"
|
|
return 1
|
|
fi
|
|
|
|
# Extract SOURCE_DATE_EPOCH from changelog
|
|
if [ -z "${SOURCE_DATE_EPOCH:-}" ]; then
|
|
if [ -f "$src_dir/debian/changelog" ]; then
|
|
SOURCE_DATE_EPOCH=$(dpkg-parsechangelog -l "$src_dir/debian/changelog" -S Timestamp 2>/dev/null || date +%s)
|
|
export SOURCE_DATE_EPOCH
|
|
fi
|
|
fi
|
|
|
|
echo "$src_dir"
|
|
}
|
|
|
|
install_build_deps() {
|
|
local src_dir="$1"
|
|
|
|
log "Installing build dependencies"
|
|
cd "$src_dir"
|
|
sudo apt-get build-dep -y . || true
|
|
}
|
|
|
|
apply_patches() {
|
|
local src_dir="$1"
|
|
shift
|
|
|
|
cd "$src_dir"
|
|
for patch_url in "$@"; do
|
|
log "Applying patch: $patch_url"
|
|
curl -sSL "$patch_url" | patch -p1
|
|
done
|
|
}
|
|
|
|
build_package() {
|
|
local pkg="$1"
|
|
local ver="$2"
|
|
shift 2
|
|
local patches="${@:-}"
|
|
|
|
log "Building $pkg version $ver"
|
|
|
|
setup_reproducible_env "$pkg"
|
|
|
|
cd /build
|
|
local src_dir=$(fetch_source "$pkg" "$ver")
|
|
|
|
install_build_deps "$src_dir"
|
|
|
|
if [ -n "$patches" ]; then
|
|
apply_patches "$src_dir" $patches
|
|
fi
|
|
|
|
cd "$src_dir"
|
|
|
|
# Build with reproducible settings
|
|
dpkg-buildpackage -b -us -uc
|
|
|
|
# Copy output
|
|
local out_dir="$OUTPUT_DIR/$pkg-$ver"
|
|
mkdir -p "$out_dir"
|
|
cp -r /build/src/*.deb "$out_dir/" 2>/dev/null || true
|
|
|
|
# Extract and fingerprint
|
|
for deb in "$out_dir"/*.deb; do
|
|
[ -f "$deb" ] || continue
|
|
local deb_name=$(basename "$deb" .deb)
|
|
mkdir -p "$out_dir/extracted/$deb_name"
|
|
dpkg-deb -x "$deb" "$out_dir/extracted/$deb_name"
|
|
|
|
# Extract function fingerprints
|
|
/usr/local/bin/extract-functions.sh "$out_dir/extracted/$deb_name" > "$out_dir/$deb_name.functions.json"
|
|
done
|
|
|
|
log "Build complete: $out_dir"
|
|
}
|
|
|
|
diff_versions() {
|
|
local pkg="$1"
|
|
local vuln_ver="$2"
|
|
local patched_ver="$3"
|
|
|
|
log "Building and diffing $pkg: $vuln_ver vs $patched_ver"
|
|
|
|
# Build vulnerable version
|
|
build_package "$pkg" "$vuln_ver"
|
|
|
|
# Clean build environment
|
|
rm -rf /build/src/*
|
|
|
|
# Build patched version
|
|
build_package "$pkg" "$patched_ver"
|
|
|
|
# Compute diff
|
|
local diff_out="$OUTPUT_DIR/$pkg-diff-$vuln_ver-vs-$patched_ver.json"
|
|
|
|
jq -s '
|
|
.[0] as $vuln |
|
|
.[1] as $patched |
|
|
{
|
|
package: "'"$pkg"'",
|
|
vulnerable_version: "'"$vuln_ver"'",
|
|
patched_version: "'"$patched_ver"'",
|
|
vulnerable_functions: ($vuln | length),
|
|
patched_functions: ($patched | length),
|
|
added: [($patched[] | select(.name as $n | ($vuln | map(.name) | index($n)) == null))],
|
|
removed: [($vuln[] | select(.name as $n | ($patched | map(.name) | index($n)) == null))],
|
|
modified: [
|
|
$vuln[] | .name as $n | .hash as $h |
|
|
($patched[] | select(.name == $n and .hash != $h)) |
|
|
{name: $n, vuln_hash: $h, patched_hash: .hash}
|
|
]
|
|
}
|
|
' \
|
|
"$OUTPUT_DIR/$pkg-$vuln_ver"/*.functions.json \
|
|
"$OUTPUT_DIR/$pkg-$patched_ver"/*.functions.json \
|
|
> "$diff_out" 2>/dev/null || log "Warning: Could not compute diff"
|
|
|
|
log "Diff complete: $diff_out"
|
|
}
|
|
|
|
case "$COMMAND" in
|
|
build)
|
|
if [ -z "$PACKAGE" ]; then
|
|
log "ERROR: Package required"
|
|
show_help
|
|
exit 1
|
|
fi
|
|
shift 2 # Remove command, package
|
|
[ -n "${VERSION:-}" ] && shift # Remove version if present
|
|
build_package "$PACKAGE" "${VERSION:-}" "$@"
|
|
;;
|
|
diff)
|
|
PATCHED_VERSION="${4:-}"
|
|
if [ -z "$PACKAGE" ] || [ -z "$VERSION" ] || [ -z "$PATCHED_VERSION" ]; then
|
|
log "ERROR: Package, vulnerable version, and patched version required"
|
|
show_help
|
|
exit 1
|
|
fi
|
|
diff_versions "$PACKAGE" "$VERSION" "$PATCHED_VERSION"
|
|
;;
|
|
--help|help)
|
|
show_help
|
|
;;
|
|
*)
|
|
log "ERROR: Unknown command: $COMMAND"
|
|
show_help
|
|
exit 1
|
|
;;
|
|
esac
|