From 61e201abb2d5e4cdddaa0b597f72d161340e36cc Mon Sep 17 00:00:00 2001
From: Kailun Qin <kailun.qin@intel.com>
Date: Wed, 30 Jun 2021 08:33:21 -0400
Subject: [PATCH 1/2] makefile: update ldflags and add strip for static builds

This patch
* drops the default `-w` flag for `make static`, which helps with
  debugging the static runc binary;
* adds `EXTRA_LDFLAGS="-w -s"` to `script/release.sh` to disable DWARF
  generation and symbol table for the release runc binary;
* adds strip in `script/release.sh` for a further size-optimized release
  runc binary.

Signed-off-by: Kailun Qin <kailun.qin@intel.com>
---
 Makefile          | 2 +-
 script/release.sh | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index bacbf1e00..d386048df 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@ endif
 GO_BUILD := $(GO) build -trimpath $(GO_BUILDMODE) $(EXTRA_FLAGS) -tags "$(BUILDTAGS)" \
 	-ldflags "-X main.gitCommit=$(COMMIT) -X main.version=$(VERSION) $(EXTRA_LDFLAGS)"
 GO_BUILD_STATIC := CGO_ENABLED=1 $(GO) build -trimpath $(EXTRA_FLAGS) -tags "$(BUILDTAGS) netgo osusergo" \
-	-ldflags "-w -extldflags -static -X main.gitCommit=$(COMMIT) -X main.version=$(VERSION) $(EXTRA_LDFLAGS)"
+	-ldflags "-extldflags -static -X main.gitCommit=$(COMMIT) -X main.version=$(VERSION) $(EXTRA_LDFLAGS)"
 
 .DEFAULT: runc
 
diff --git a/script/release.sh b/script/release.sh
index b04fe0091..ea008b682 100755
--- a/script/release.sh
+++ b/script/release.sh
@@ -33,6 +33,7 @@ function build_project() {
 	local libseccomp_ver='2.5.1'
 	local tarball="libseccomp-${libseccomp_ver}.tar.gz"
 	local prefix
+	local ldflags="-w -s"
 	prefix="$(mktemp -d)"
 	wget "https://github.com/seccomp/libseccomp/releases/download/v${libseccomp_ver}/${tarball}"{,.asc}
 	tar xf "$tarball"
@@ -46,8 +47,9 @@ function build_project() {
 	# Add -a to go build flags to make sure it links against
 	# the provided libseccomp, not the system one (otherwise
 	# it can reuse cached pkg-config results).
-	make -C "$root" PKG_CONFIG_PATH="${prefix}/lib/pkgconfig" COMMIT_NO= EXTRA_FLAGS="-a" static
+	make -C "$root" PKG_CONFIG_PATH="${prefix}/lib/pkgconfig" COMMIT_NO= EXTRA_FLAGS="-a" EXTRA_LDFLAGS="${ldflags}" static
 	rm -rf "$prefix"
+	strip "$root/$project"
 	mv "$root/$project" "$1"
 }
 

From 18f434e10a7ebb4a31aefc2a970d8f88e16fe07f Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Mon, 19 Jul 2021 14:20:18 -0700
Subject: [PATCH 2/2] script/release.sh: make builds reproducible

What it takes is add an empty buildid, which, together with previously
added strip invocation, results in reproducible build!

NB: earlier versions of this patch also added the following:

1. non-random libseccomp install $prefix;

2. "objcopy --enable-deterministic-archives $prefix/lib/libseccomp.a"
   to strip ar dates and UIDs/GIDs;

3. "-B=0x00" to EXTRA_LDFLAGS to have non-variable NT_GNU_BUILD_ID.

Apparently, all this is not needed with strip.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 script/release.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/script/release.sh b/script/release.sh
index ea008b682..b9d893bf7 100755
--- a/script/release.sh
+++ b/script/release.sh
@@ -33,7 +33,6 @@ function build_project() {
 	local libseccomp_ver='2.5.1'
 	local tarball="libseccomp-${libseccomp_ver}.tar.gz"
 	local prefix
-	local ldflags="-w -s"
 	prefix="$(mktemp -d)"
 	wget "https://github.com/seccomp/libseccomp/releases/download/v${libseccomp_ver}/${tarball}"{,.asc}
 	tar xf "$tarball"
@@ -44,6 +43,11 @@ function build_project() {
 	)
 	mv "$tarball"{,.asc} "$builddir"
 
+	# For reproducible builds, add these to EXTRA_LDFLAGS:
+	#  -w to disable DWARF generation;
+	#  -s to disable symbol table;
+	#  -buildid= to remove variable build id.
+	local ldflags="-w -s -buildid="
 	# Add -a to go build flags to make sure it links against
 	# the provided libseccomp, not the system one (otherwise
 	# it can reuse cached pkg-config results).