Make tar2ext4 deterministic with files without parent dir in tar#2270
Merged
anmaxvl merged 4 commits intomicrosoft:mainfrom Sep 25, 2024
Merged
Conversation
Signed-off-by: Takuro Sato <takurosato@microsoft.com>
6d01bd3 to
d43c1e8
Compare
Signed-off-by: Takuro Sato <takurosato@microsoft.com>
BryceDFisher
approved these changes
Sep 24, 2024
anmaxvl
approved these changes
Sep 24, 2024
Contributor
Author
|
@anmaxvl You might have already checked it, but as I mentioned in the PR description the tests under |
helsaawy
approved these changes
Sep 24, 2024
ext4/tar2ext4/tar2ext4_test.go
Outdated
|
|
||
| opts := []Option{ConvertWhiteout} | ||
|
|
||
| tmpVhdPath := filepath.Join(os.TempDir(), "test-vhd.ext4") |
Contributor
There was a problem hiding this comment.
Minor nit: its not a VHD, since there is no VHD footer option
Signed-off-by: Takuro Sato <takurosato@microsoft.com>
hgarvison
pushed a commit
to hgarvison/hcsshim
that referenced
this pull request
Sep 27, 2024
…rosoft#2270) Make tar2ext4 deterministic with files without parent dir in tar Signed-off-by: Takuro Sato <takurosato@microsoft.com> Signed-off-by: Heather Garvison <hgarvison@microsoft.com>
anmaxvl
pushed a commit
that referenced
this pull request
Jan 2, 2026
Make tar2ext4 deterministic with files without parent dir in tar Signed-off-by: Takuro Sato <takurosato@microsoft.com> (cherry picked from commit 16dc8eb)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem to fix
./dmverity-vhd roothashis not deterministic for some file docker images.The above command shows a diff which suggest it's not deterministic.
This is causing a problem for
az confcomtool that the generated security policy is not consistent for each run (./dmverity-vhd roothashis called here).Container deployment is blocked as well for C-ACI.
Cause of the problem
In the example image, there is a problematic tar file only with a file
etc/nsswitch.conf. For most of tar files there would be alsoetc/directory as the parent ofnsswitch.conf, but for this specific tar there isn't.For the such files without parent,
MakeParents()makes the parent directories for ext4, but it usestime.Now()and it's causing the non-deterministic behavior.Fix
Change
time.Now()to the child's value.Test
diff bad-debian-1.txt bad-debian-2.txtdoesn't show any diff after the fixgo test ./ext4/tar2ext4/.... It includes new a unit test case.Note
go test ./ext4/internal/compactext4/...is broken, but it seems to be the case even for main branch. Does anyone now the problem?