monolith-os/monolith
1
1
Fork 0
Code Issues Pull requests Projects Releases 40 Packages 20 Wiki Activity Actions 1

Restore the rpm mtime on vmlinuz after signing #74

Merged
TheDarkWizard merged 1 commit from pin-vmlinuz-mtime into main 2026-07-20 06:10:16 +00:00
Conversation 1 Commits 1 Files changed 1 +7 -1
TheDarkWizard commented 2026-07-20 05:21:11 +00:00
Owner
Copy link

Follow-up to 55d5035: the faketime pin made the signature bytes deterministic, but the ~290MB kernel-cachyos layer still churned nightly. sbsign writes a fresh output file whose mtime is the real build wallclock (LD_PRELOAD can't fake what the kernel stamps on the inode), and chunkah embeds mtimes in the layer tar, so the layer re-hashed on every build even when the kernel didn't change. Confirmed by diffing the gnome 20260717/20260718 amd64 manifests: the layer changed on a day with no kernel-cachyos update.

Touch vmlinuz back to the rpm's timestamp (the same instant the signature is already pinned to). Verify by checking the kernel layer digest stays identical across the next two nightlies without a kernel update.

Should cut roughly 290MB per edition per nightly off both the runner pushes and every machine's daily update.

Follow-up to 55d5035: the faketime pin made the signature bytes deterministic, but the ~290MB kernel-cachyos layer still churned nightly. sbsign writes a fresh output file whose mtime is the real build wallclock (LD_PRELOAD can't fake what the kernel stamps on the inode), and chunkah embeds mtimes in the layer tar, so the layer re-hashed on every build even when the kernel didn't change. Confirmed by diffing the gnome 20260717/20260718 amd64 manifests: the layer changed on a day with no kernel-cachyos update. Touch vmlinuz back to the rpm's timestamp (the same instant the signature is already pinned to). Verify by checking the kernel layer digest stays identical across the next two nightlies without a kernel update. Should cut roughly 290MB per edition per nightly off both the runner pushes and every machine's daily update.
Restore the rpm mtime on vmlinuz after signing
Some checks failed
bluebuild / Check if a rebuild is needed (pull_request) Successful in 4m26s
Details
PR Rebase Hint / Post rebase command (pull_request) Successful in 11m45s
Details
bluebuild / Release (pull_request) Has been cancelled
Details
bluebuild / Generate Release (pull_request) Has been cancelled
Details
bluebuild / Build Budgie NVIDIA (Budgie NVIDIA, recipe-budgie-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Budgie (Budgie, recipe-budgie.yml) (pull_request) Has been cancelled
Details
bluebuild / Build COSMIC NVIDIA (COSMIC NVIDIA, recipe-cosmic-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build COSMIC (COSMIC, recipe-cosmic.yml) (pull_request) Has been cancelled
Details
bluebuild / Build GNOME NVIDIA (GNOME NVIDIA, recipe-gnome-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build GNOME (GNOME, recipe-gnome.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Hyprland DMS NVIDIA (Hyprland DMS NVIDIA, recipe-hyprland-dms-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Hyprland DMS (Hyprland DMS, recipe-hyprland-dms.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Hyprland Noctalia NVIDIA (Hyprland Noctalia NVIDIA, recipe-hyprland-noctalia-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Hyprland Noctalia (Hyprland Noctalia, recipe-hyprland-noctalia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build KDE NVIDIA (KDE NVIDIA, recipe-kde-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build KDE (KDE, recipe-kde.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Niri DMS NVIDIA (Niri DMS NVIDIA, recipe-niri-dms-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Niri DMS (Niri DMS, recipe-niri-dms.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Niri Noctalia NVIDIA (Niri Noctalia NVIDIA, recipe-niri-noctalia-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Niri Noctalia (Niri Noctalia, recipe-niri-noctalia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Nourish NVIDIA (Nourish NVIDIA, recipe-nourish-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build Nourish (Nourish, recipe-nourish.yml) (pull_request) Has been cancelled
Details
bluebuild / Build XFCE NVIDIA (XFCE NVIDIA, recipe-xfce-nvidia.yml) (pull_request) Has been cancelled
Details
bluebuild / Build XFCE (XFCE, recipe-xfce.yml) (pull_request) Has been cancelled
Details
240fc17be6
 
The faketime pin from 55d5035 made the sbsign signature bytes
deterministic, but the kernel layer kept churning every night anyway:
sbsign writes a brand-new output file, and the inode mtime it gets is
the real build wallclock (LD_PRELOAD faketime only fakes the process
clock, it cannot change what the kernel stamps on the file). Chunkah
embeds mtimes in the layer tar, so the ~290MB kernel-cachyos layer
re-hashed on every build even with an identical kernel. Diffing the
gnome 20260717 and 20260718 manifests showed the layer changing on a
day kernel-cachyos did not update.

Touch vmlinuz back to the timestamp rpm gave it (the package build
time, the same instant the signature is already pinned to), so the
layer only changes when the kernel actually does.
forgejo-actions commented 2026-07-20 05:53:49 +00:00
Copy link

🧪 Test this PR on a real install

Once the build checks on this PR pass, a signed test image is published for each edition this PR builds. Pick the one matching your hardware and, from an existing Monolith install (which already has the signing policy), rebase onto it:

gnome

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/gnome:pr-74-44
systemctl reboot

kde

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/kde:pr-74-44
systemctl reboot

xfce

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/xfce:pr-74-44
systemctl reboot

cosmic

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/cosmic:pr-74-44
systemctl reboot

budgie

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/budgie:pr-74-44
systemctl reboot

hyprland-noctalia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/hyprland-noctalia:pr-74-44
systemctl reboot

hyprland-dms

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/hyprland-dms:pr-74-44
systemctl reboot

niri-noctalia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/niri-noctalia:pr-74-44
systemctl reboot

niri-dms

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/niri-dms:pr-74-44
systemctl reboot

nourish

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/nourish:pr-74-44
systemctl reboot

gnome-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/gnome-nvidia:pr-74-44
systemctl reboot

kde-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/kde-nvidia:pr-74-44
systemctl reboot

xfce-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/xfce-nvidia:pr-74-44
systemctl reboot

cosmic-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/cosmic-nvidia:pr-74-44
systemctl reboot

budgie-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/budgie-nvidia:pr-74-44
systemctl reboot

hyprland-noctalia-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/hyprland-noctalia-nvidia:pr-74-44
systemctl reboot

hyprland-dms-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/hyprland-dms-nvidia:pr-74-44
systemctl reboot

niri-noctalia-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/niri-noctalia-nvidia:pr-74-44
systemctl reboot

niri-dms-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/niri-dms-nvidia:pr-74-44
systemctl reboot

nourish-nvidia

rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/nourish-nvidia:pr-74-44
systemctl reboot

The tags are rebuilt on every new commit here, so rpm-ostree upgrade pulls the latest build. When you're done testing, return to your edition's released image (:latest).

The commands cover the editions this PR affected when it was opened; commits that touch more editions publish their tags too, just without a refreshed comment. The test tags stop updating once this PR is merged or closed.

### 🧪 Test this PR on a real install **Once the build checks on this PR pass**, a signed test image is published for each edition this PR builds. Pick the one matching your hardware and, from an existing Monolith install (which already has the signing policy), rebase onto it: **`gnome`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/gnome:pr-74-44 systemctl reboot ``` **`kde`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/kde:pr-74-44 systemctl reboot ``` **`xfce`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/xfce:pr-74-44 systemctl reboot ``` **`cosmic`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/cosmic:pr-74-44 systemctl reboot ``` **`budgie`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/budgie:pr-74-44 systemctl reboot ``` **`hyprland-noctalia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/hyprland-noctalia:pr-74-44 systemctl reboot ``` **`hyprland-dms`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/hyprland-dms:pr-74-44 systemctl reboot ``` **`niri-noctalia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/niri-noctalia:pr-74-44 systemctl reboot ``` **`niri-dms`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/niri-dms:pr-74-44 systemctl reboot ``` **`nourish`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/nourish:pr-74-44 systemctl reboot ``` **`gnome-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/gnome-nvidia:pr-74-44 systemctl reboot ``` **`kde-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/kde-nvidia:pr-74-44 systemctl reboot ``` **`xfce-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/xfce-nvidia:pr-74-44 systemctl reboot ``` **`cosmic-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/cosmic-nvidia:pr-74-44 systemctl reboot ``` **`budgie-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/budgie-nvidia:pr-74-44 systemctl reboot ``` **`hyprland-noctalia-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/hyprland-noctalia-nvidia:pr-74-44 systemctl reboot ``` **`hyprland-dms-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/hyprland-dms-nvidia:pr-74-44 systemctl reboot ``` **`niri-noctalia-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/niri-noctalia-nvidia:pr-74-44 systemctl reboot ``` **`niri-dms-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/niri-dms-nvidia:pr-74-44 systemctl reboot ``` **`nourish-nvidia`** ```bash rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/nourish-nvidia:pr-74-44 systemctl reboot ``` The tags are rebuilt on every new commit here, so `rpm-ostree upgrade` pulls the latest build. When you're done testing, return to your edition's released image (`:latest`). _The commands cover the editions this PR affected when it was opened; commits that touch more editions publish their tags too, just without a refreshed comment. The test tags stop updating once this PR is merged or closed._
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
dependencies
Pull requests that update a dependency file

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
github_actions
Pull requests that update GitHub Actions code

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
dependencies
documentation
duplicate
enhancement
github_actions
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
monolith-os/monolith!74
No description provided.