Re: [meta-virtualization][PATCH 1/2] improve reproducibility

On Fri, Feb 6, 2026 at 7:49 AM Bruce Ashfield via lists.yoctoproject.org
<[email protected]> wrote:

>
>
> On Fri, Feb 6, 2026 at 4:17 AM Changqing Li via lists.yoctoproject.org <
> [email protected]> wrote:
>
>> From: Changqing Li <[email protected]>
>>
>> * Refer [1], cgo will embeded cgo_ldflags in the intermediary output,
>>   which make content ID will be incfluenced by cgo_ldflags.
>>   '--sysroot=xxx' includes build path, which will make the binary not
>>   reproducible, these recipes can build successfully without --sysroot, so
>>   remove it
>>
>> * CGO_ENABLED/CGO_CFLAGS/CGO_LDFLAGS already exported in go.bbclass with
>>   the same value, remove the not needed settings
>>
>
> refer to all my previous email on the subject.
>
> I will continue to set these in the classes themselves.
>

BUT, I will take the removal of the sysroot if we no longer need it.

But the duplicated values from the go classes are entirely intentional.

Bruce



>
> Bruce
>
>
>
>>
>> [1]
>> https://git.openembedded.org/openembedded-core/commit/?id=1797741aad02b8bf429fac4b81e30cdda64b5448
>>
>> Signed-off-by: Changqing Li <[email protected]>
>> ---
>>  recipes-containers/containerd/containerd_git.bb           | 3 ---
>>  recipes-containers/cri-tools/cri-tools_git.bb             | 5 -----
>>  recipes-containers/docker-compose/docker-compose_git.bb   | 6 +-----
>>  .../docker-distribution/docker-distribution_git.bb        | 3 ---
>>  recipes-containers/docker/docker.inc                      | 4 ----
>>  recipes-containers/kubernetes/kubernetes_git.bb           | 8 +++++---
>>  recipes-containers/nerdctl/nerdctl_git.bb                 | 6 ------
>>  recipes-containers/oci-image-tools/oci-image-tools_git.bb | 3 ---
>>  .../oci-runtime-tools/oci-runtime-tools_git.bb            | 3 ---
>>  recipes-containers/podman/podman_git.bb                   | 8 --------
>>  recipes-containers/runc/runc.inc                          | 3 ---
>>  recipes-containers/skopeo/skopeo_git.bb                   | 3 ---
>>  recipes-containers/umoci/umoci_git.bb                     | 3 ---
>>  13 files changed, 6 insertions(+), 52 deletions(-)
>>
>> diff --git a/recipes-containers/containerd/containerd_git.bb
>> b/recipes-containers/containerd/containerd_git.bb
>> index 081cf354..3d66e06e 100644
>> --- a/recipes-containers/containerd/containerd_git.bb
>> +++ b/recipes-containers/containerd/containerd_git.bb
>> @@ -47,9 +47,6 @@ do_compile() {
>>
>>      # Pass the needed cflags/ldflags so that cgo
>>      # can find the needed headers files and libraries
>> -    export CGO_ENABLED="1"
>> -    export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -    export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>>      export BUILDTAGS="no_btrfs static_build netgo"
>>      export CFLAGS="${CFLAGS}"
>>      export LDFLAGS="${LDFLAGS}"
>> diff --git a/recipes-containers/cri-tools/cri-tools_git.bb
>> b/recipes-containers/cri-tools/cri-tools_git.bb
>> index dad675e8..98c43b6b 100644
>> --- a/recipes-containers/cri-tools/cri-tools_git.bb
>> +++ b/recipes-containers/cri-tools/cri-tools_git.bb
>> @@ -46,12 +46,7 @@ do_compile() {
>>         export
>> GOPATH="${S}/src/import/.gopath:${S}/src/import/vendor:${STAGING_DIR_TARGET}/${prefix}/local/go"
>>         cd ${S}/src/import
>>
>> -       # Build the target binaries
>> -       export GOARCH="${TARGET_GOARCH}"
>>         # Pass the needed cflags/ldflags so that cgo can find the needed
>> headers files and libraries
>> -       export CGO_ENABLED="1"
>> -       export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -       export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>>         export CFLAGS=""
>>         export LDFLAGS=""
>>         export CC="${CC}"
>> diff --git a/recipes-containers/docker-compose/docker-compose_git.bb
>> b/recipes-containers/docker-compose/docker-compose_git.bb
>> index ccb36a16..de9427ae 100644
>> --- a/recipes-containers/docker-compose/docker-compose_git.bb
>> +++ b/recipes-containers/docker-compose/docker-compose_git.bb
>> @@ -53,13 +53,9 @@ do_compile() {
>>
>>         # GOMODCACHE, GOPROXY, GOSUMDB, GOTOOLCHAIN are set by
>> go-mod-vcs.bbclass
>>         export
>> GOPATH="${S}/src/import/.gopath:${STAGING_DIR_TARGET}/${prefix}/local/go"
>> -       export CGO_ENABLED="1"
>>
>>         # Pass the needed cflags/ldflags so that cgo
>>         # can find the needed headers files and libraries
>> -       export GOARCH=${TARGET_GOARCH}
>> -       export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -       export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>>
>>         GO_LDFLAGS="-s -w -X internal.Version=${PV} -X
>> ${COMPOSE_PKG}/internal.Version=${PV}"
>>         GO_BUILDTAGS=""
>> @@ -85,4 +81,4 @@ INSANE_SKIP:${PN} += "ldflags already-stripped"
>>
>>  # the AWS dependency is 8GB, try and control the
>>  # size of the clones
>> -BB_GIT_SHALLOW = "1"
>> \ No newline at end of file
>> +BB_GIT_SHALLOW = "1"
>> diff --git a/recipes-containers/docker-distribution/
>> docker-distribution_git.bb b/recipes-containers/docker-distribution/
>> docker-distribution_git.bb
>> index 5e37fe74..63001331 100644
>> --- a/recipes-containers/docker-distribution/docker-distribution_git.bb
>> +++ b/recipes-containers/docker-distribution/docker-distribution_git.bb
>> @@ -28,12 +28,9 @@ do_compile() {
>>         export GOROOT="${STAGING_LIBDIR}/go"
>>         # Pass the needed cflags/ldflags so that cgo
>>         # can find the needed headers files and libraries
>> -       export CGO_ENABLED="1"
>>         export CFLAGS=""
>>         export LDFLAGS=""
>> -       export CGO_CFLAGS="${TARGET_CFLAGS}"
>>         export GO_GCFLAGS=""
>> -       export CGO_LDFLAGS="${TARGET_LDFLAGS}"
>>         export GO111MODULE=off
>>         export GO_BUILD_FLAGS="-trimpath"
>>
>> diff --git a/recipes-containers/docker/docker.inc
>> b/recipes-containers/docker/docker.inc
>> index 99535a77..b0f52d77 100644
>> --- a/recipes-containers/docker/docker.inc
>> +++ b/recipes-containers/docker/docker.inc
>> @@ -80,10 +80,6 @@ do_compile() {
>>
>>         # Pass the needed cflags/ldflags so that cgo
>>         # can find the needed headers files and libraries
>> -       export GOARCH=${TARGET_GOARCH}
>> -       export CGO_ENABLED="1"
>> -       export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -       export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>>         export DOCKER_BUILDTAGS='${BUILD_TAGS} ${PACKAGECONFIG_CONFARGS}'
>>         export GO111MODULE=off
>>
>> diff --git a/recipes-containers/kubernetes/kubernetes_git.bb
>> b/recipes-containers/kubernetes/kubernetes_git.bb
>> index f7b6940a..89c53930 100644
>> --- a/recipes-containers/kubernetes/kubernetes_git.bb
>> +++ b/recipes-containers/kubernetes/kubernetes_git.bb
>> @@ -54,6 +54,9 @@ inherit cni_networking
>>
>>  COMPATIBLE_HOST = '(x86_64.*|arm.*|aarch64.*)-linux'
>>
>> +CGO_LDFLAGS ?= "${LDFLAGS}"
>> +CGO_LDFLAGS:remove = "${DEBUG_PREFIX_MAP}"
>> +
>>  do_compile() {
>>         export
>> GOPATH="${S}/src/import/.gopath:${S}/src/import/vendor:${STAGING_DIR_TARGET}/${prefix}/local/go:${UNPACKDIR}/git/"
>>         cd ${S}
>> @@ -70,7 +73,6 @@ do_compile() {
>>         export CGO_LDFLAGS="$(echo ${BUILD_LDFLAGS} | sed 's/-Wl,-O1//g'
>> | sed 's/-Wl,--dynamic-linker.*?\( \|$\)//g')"
>>         export CC="${BUILD_CC}"
>>         export LD="${BUILD_LD}"
>> -
>>         # set the toolchain to local to avoid an attempted fetch of
>>         # valiation by the build
>>         # https://github.com/actions/setup-go/issues/420
>> @@ -85,8 +87,8 @@ do_compile() {
>>         export GOARCH="${TARGET_GOARCH}"
>>         # Pass the needed cflags/ldflags so that cgo can find the needed
>> headers files and libraries
>>         export CGO_ENABLED="1"
>> -       export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -       export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> +       export CGO_CFLAGS="${CFLAGS}"
>> +       export CGO_LDFLAGS="${CGO_LDFLAGS}"
>>         export CFLAGS=""
>>         export LDFLAGS=""
>>         export CC="${CC}"
>> diff --git a/recipes-containers/nerdctl/nerdctl_git.bb
>> b/recipes-containers/nerdctl/nerdctl_git.bb
>> index 8f63b48c..eb873e23 100644
>> --- a/recipes-containers/nerdctl/nerdctl_git.bb
>> +++ b/recipes-containers/nerdctl/nerdctl_git.bb
>> @@ -71,12 +71,6 @@ do_compile() {
>>
>>          cd ${S}/src/import
>>
>> -        # Pass the needed cflags/ldflags so that cgo
>> -        # can find the needed headers files and libraries
>> -        export GOARCH=${TARGET_GOARCH}
>> -        export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -        export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -
>>          # -trimpath removes build paths from the binary (required for
>> reproducible builds)
>>          oe_runmake GO=${GO} BUILDTAGS="${BUILDTAGS}"
>> GO_BUILD_FLAGS="-trimpath" binaries
>>  }
>> diff --git a/recipes-containers/oci-image-tools/oci-image-tools_git.bb
>> b/recipes-containers/oci-image-tools/oci-image-tools_git.bb
>> index 36026214..6c355377 100644
>> --- a/recipes-containers/oci-image-tools/oci-image-tools_git.bb
>> +++ b/recipes-containers/oci-image-tools/oci-image-tools_git.bb
>> @@ -29,11 +29,8 @@ do_compile() {
>>
>>         # Pass the needed cflags/ldflags so that cgo
>>         # can find the needed headers files and libraries
>> -       export CGO_ENABLED="1"
>>         export CFLAGS=""
>>         export LDFLAGS=""
>> -       export CGO_CFLAGS="${TARGET_CFLAGS}"
>> -       export CGO_LDFLAGS="${TARGET_LDFLAGS}"
>>         export GO111MODULE=off
>>
>>         export GOBUILDFLAGS="-trimpath"
>> diff --git a/recipes-containers/oci-runtime-tools/
>> oci-runtime-tools_git.bb b/recipes-containers/oci-runtime-tools/
>> oci-runtime-tools_git.bb
>> index 81f51f9c..0ba69756 100644
>> --- a/recipes-containers/oci-runtime-tools/oci-runtime-tools_git.bb
>> +++ b/recipes-containers/oci-runtime-tools/oci-runtime-tools_git.bb
>> @@ -25,11 +25,8 @@ do_compile() {
>>
>>         # Pass the needed cflags/ldflags so that cgo
>>         # can find the needed headers files and libraries
>> -       export CGO_ENABLED="1"
>>         export CFLAGS=""
>>         export LDFLAGS=""
>> -       export CGO_CFLAGS="${TARGET_CFLAGS}"
>> -       export CGO_LDFLAGS="${TARGET_LDFLAGS}"
>>         export GO111MODULE=off
>>         export GOFLAGS="-mod=vendor"
>>
>> diff --git a/recipes-containers/podman/podman_git.bb
>> b/recipes-containers/podman/podman_git.bb
>> index f09e01f8..5e5f1f9b 100644
>> --- a/recipes-containers/podman/podman_git.bb
>> +++ b/recipes-containers/podman/podman_git.bb
>> @@ -78,19 +78,11 @@ do_compile() {
>>
>>         ln -sf "../../../import/vendor/github.com/varlink/" ".gopath/src/
>> github.com/varlink"
>>
>> -       export GOARCH="${BUILD_GOARCH}"
>>         export GOPATH="${S}/src/.gopath"
>>         export
>> GOROOT="${STAGING_DIR_NATIVE}/${nonarch_libdir}/${HOST_SYS}/go"
>>
>>         cd ${S}/src/.gopath/src/"${PODMAN_PKG}"
>>
>> -       # Pass the needed cflags/ldflags so that cgo
>> -       # can find the needed headers files and libraries
>> -       export GOARCH=${TARGET_GOARCH}
>> -       export CGO_ENABLED="1"
>> -       export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -       export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -
>>         # podman now builds go-md2man and requires the host/build details
>>         export NATIVE_GOOS=${BUILD_GOOS}
>>         export NATIVE_GOARCH=${BUILD_GOARCH}
>> diff --git a/recipes-containers/runc/runc.inc
>> b/recipes-containers/runc/runc.inc
>> index b834ab14..ebff354f 100644
>> --- a/recipes-containers/runc/runc.inc
>> +++ b/recipes-containers/runc/runc.inc
>> @@ -57,9 +57,6 @@ do_compile() {
>>
>>         # Pass the needed cflags/ldflags so that cgo
>>         # can find the needed headers files and libraries
>> -       export CGO_ENABLED="1"
>> -       export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>> -       export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
>>         export GO=${GO}
>>
>>         export CFLAGS=""
>> diff --git a/recipes-containers/skopeo/skopeo_git.bb
>> b/recipes-containers/skopeo/skopeo_git.bb
>> index 936d2c3d..1542f2a6 100644
>> --- a/recipes-containers/skopeo/skopeo_git.bb
>> +++ b/recipes-containers/skopeo/skopeo_git.bb
>> @@ -53,11 +53,8 @@ do_compile() {
>>
>>         # Pass the needed cflags/ldflags so that cgo
>>         # can find the needed headers files and libraries
>> -       export CGO_ENABLED="1"
>>         export CFLAGS=""
>>         export LDFLAGS=""
>> -       export CGO_CFLAGS="${TARGET_CFLAGS}"
>> -       export CGO_LDFLAGS="${TARGET_LDFLAGS}"
>>
>>         export GO111MODULE=off
>>         export EXTRA_LDFLAGS="-s -w"
>> diff --git a/recipes-containers/umoci/umoci_git.bb
>> b/recipes-containers/umoci/umoci_git.bb
>> index f148b7fa..32868594 100644
>> --- a/recipes-containers/umoci/umoci_git.bb
>> +++ b/recipes-containers/umoci/umoci_git.bb
>> @@ -62,11 +62,8 @@ do_compile() {
>>
>>      # Pass the needed cflags/ldflags so that cgo
>>      # can find the needed headers files and libraries
>> -    export CGO_ENABLED="1"
>>      export CFLAGS=""
>>      export LDFLAGS=""
>> -    export CGO_CFLAGS="${TARGET_CFLAGS}"
>> -    export CGO_LDFLAGS="${TARGET_LDFLAGS}"
>>
>>      export GO111MODULE=off
>>
>> --
>> 2.34.1
>>
>>
>>
>>
>>
>
> --
> - Thou shalt not follow the NULL pointer, for chaos and madness await thee
> at its end
> - "Use the force Harry" - Gandalf, Star Trek II
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#9563):
> https://lists.yoctoproject.org/g/meta-virtualization/message/9563
> Mute This Topic: https://lists.yoctoproject.org/mt/117668816/1050810
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [
> [email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II