Skip to content

[build-hooks] Fix reproducible build: pin apt versions and track autoremove #25552

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lihuay merged 4 commits into from
Mar 13, 2026
Merged

[build-hooks] Fix reproducible build: pin apt versions and track autoremove #25552

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3a3fa74
[build-hooks] Fix reproducible build: pin apt versions and track auto…
rustiqly Feb 18, 2026
c54ecbd
fix check_apt_version: local VERSION_FILE + awk exact match
rustiqly Feb 23, 2026
03027ee
fix pin_apt_versions: strip +fips suffix for non-FIPS builds
rustiqly Feb 24, 2026
d5f2b87
Drop pin_apt_versions, rely solely on preferences.d for version control
rustiqly Feb 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions src/sonic-build-hooks/hooks/apt-get
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,9 @@ if [ "$INSTALL" == y ]; then
[ "$lock_result" == y ] && release_apt_installation_lock
exit $command_result
else
if [[ " $@ " == *" purge "* || " $@ " == *" remove "* ]]; then
# When running the purge command, collect the debian versions
if [[ " $@ " == *" purge "* || " $@ " == *" remove "* || " $@ " == *" autoremove "* ]]; then
# When running purge/remove/autoremove, collect the debian versions
# so intermediate packages are captured for reproducible builds
dpkg-query -W -f '${Package}==${Version}\n' >> $POST_VERSION_PATH/purge-versions-deb
chmod a+wr $POST_VERSION_PATH/purge-versions-deb
fi
Expand Down
7 changes: 5 additions & 2 deletions src/sonic-build-hooks/scripts/buildinfo_base.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -423,7 +423,7 @@ check_dpkg_need_lock()
# Print warning message if a debian package version not specified when debian version control enabled.
check_apt_version()
{
VERSION_FILE="${VERSION_PATH}/versions-deb"
local VERSION_FILE="${VERSION_PATH}/versions-deb"
local install=$(check_apt_install "$@")
if [ "$ENABLE_VERSION_CONTROL_DEB" == "y" ] && [ "$install" == "y" ]; then
for para in "$@"
Expand All @@ -440,7 +440,7 @@ check_apt_version()
continue
else
package=$para
if ! grep -q "^${package}=" $VERSION_FILE; then
if ! grep -q "^${package}==" "$VERSION_FILE"; then
echo "Warning: the version of the package ${package} is not specified." 1>&2
fi
fi
Expand Down Expand Up @@ -487,6 +487,9 @@ update_preference_deb()
for pacakge_version in $(cat "$version_file"); do
package=$(echo $pacakge_version | awk -F"==" '{print $1}')
version=$(echo $pacakge_version | awk -F"==" '{print $2}')
# Strip +fips suffix — FIPS packages are locally rebuilt
# and not available from Debian apt repos
version="${version%+fips}"
echo -e "Package: $package\nPin: version $version\nPin-Priority: 999\n\n" >> $VERSION_DEB_PREFERENCE
done
fi
Expand Down
Loading