AI-assisted fork master: build reproducibility and build-step fixes (removes some upstream CI -- see description)

build-steps.d/2100_create-debian-packages

@@ -26,6 +26,7 @@ set -o pipefail
 set -o errtrace
 shopt -s inherit_errexit
 shopt -s shift_verbose
+export LC_ALL=C
 
 true "INFO: Currently running script: ${BASH_SOURCE[0]} $*"
 
@@ -411,25 +412,33 @@ create_derivative_distribution_debian_packages() {
          fi
          base_name="${item##*/}"
          ## 'Architecture:' currently in ./packages/$derivative_name_item/ folder: all / any /
-         ## amd64 / linux-amd64.
-         if grep --invert-match -- "#" "${control_file}" | grep -- "Architecture:" | grep --fixed-strings -- "all" >/dev/null 2>&1 ; then
-            true "DEBUG: ${base_name} Architecture: all"
-         elif grep --invert-match -- "#" "${control_file}" | grep -- "Architecture:" | grep --fixed-strings -- "any" >/dev/null 2>&1 ; then
-            true "DEBUG: ${base_name} Architecture: any"
-         elif grep --invert-match -- "#" "${control_file}" | grep -- "Architecture:" | grep --fixed-strings -- "amd64" >/dev/null 2>&1 ; then
-            if [ ! "${dist_build_target_arch:-}" = "amd64" ]; then
-               true "${cyan}INFO: Skipping platform 'amd64' specific package ${base_name} as expected.${reset}"
-               continue
-            fi
-         elif grep --invert-match -- "#" "${control_file}" | grep -- "Architecture:" | grep --fixed-strings -- "linux-amd64" >/dev/null 2>&1 ; then
-            if [ ! "${dist_build_target_arch:-}" = "amd64" ]; then
-               true "${cyan}INFO: Skipping platform 'linux-amd64' specific package ${base_name} as expected.${reset}"
-               continue
-            fi
-         else
-            grep -- "Architecture:" "${control_file}" || true
-            error "unknown Architecture: in ${control_file}"
-         fi
+         ## amd64 / linux-amd64. Capture the non-comment 'Architecture:' line(s) once, then
+         ## match by substring (same order and semantics as the previous grep chain). '*amd64*'
+         ## also matches 'linux-amd64', so both amd64 spellings share the one amd64-only path.
+         architecture_field="$(grep --invert-match -- "#" "${control_file}" | grep -- "Architecture:" || true)"
+         case "${architecture_field}" in
+            *all*)
+               true "DEBUG: ${base_name} Architecture: all"
+               ;;
+            *any*)
+               true "DEBUG: ${base_name} Architecture: any"
+               ;;
+            *amd64*)
+               ## Covers both 'amd64' and 'linux-amd64' (the latter contains 'amd64').
+               if [ ! "${dist_build_target_arch:-}" = "amd64" ]; then
+                  true "${cyan}INFO: Skipping platform 'amd64' specific package ${base_name} as expected.${reset}"
+                  continue
+               fi
+               ;;
+            *)
+               grep -- "Architecture:" "${control_file}" || true
+               error "unknown Architecture: in ${control_file}"
+               ;;
+         esac
+         ## Fast local iteration (opt-in): skip a package already published in the
+         ## local reprepro repo at its current changelog version. Off by default,
+         ## so editing a package without bumping debian/changelog is not silently
+         ## skipped. Bump the changelog (or unset the flag) to force a rebuild.
          if [ "${dist_build_skip_published_packages:-}" = "true" ] \
             && ! dm_package_needs_rebuild "${item}" "${dist_build_apt_codename}" "${derivative_name_item}"; then
             true "${cyan}INFO: Skipping up-to-date package ${base_name} (already published and not modified).${reset}"

build-steps.d/3500_install-packages

@@ -546,7 +546,7 @@ ${dist_build_script_skip_package_install}${reset}"
    ## NOTE: 'build-steps.d/*_create-lb-iso' also uses 'set-grub-keymap'. Should use the same/similar options.
    chroot_run set-grub-keymap --build-all --no-live-changes
 
-   if printf "%s\n" "${BUILD_INITRAMFS_PKGS}" | grep -q dracut ; then
+   if printf "%s\n" "${BUILD_INITRAMFS_PKGS}" | grep --quiet dracut ; then
       ## dracut is automatically run during above package installation through the usual
       ## Debian package triggers might break the boot process. Re-running dracut with
       ## the correct command line parameters is required in order to fix that.
@@ -606,12 +606,26 @@ ${dist_build_script_skip_package_install}${reset}"
    ## which then results in an unbootable system.
 
    ## '--smbios-reader true': let vm-config-dist's etc/grub.d/01_smbios-reader and
-   ## etc/default/grub.d/99_smbios-cmdline.cfg emit the SMBIOS cmdline reader.
+   ## etc/default/grub.d/99_smbios-cmdline.cfg emit the SMBIOS cmdline reader and
+   ## its ${dm_smbios_extra} placeholder. Both are opt-in and default OFF, so a
+   ## released image carries neither. Written BEFORE grub-mkconfig below, which is
+   ## what turns the drop-in into grub.cfg content.
+   ##
+   ## Sorts before 99_smbios-cmdline.cfg, which is where the variable is read and
+   ## exported to the /etc/grub.d helpers; grub-mkconfig sources
+   ## /etc/default/grub.d/*.cfg in glob order.
+   ##
+   ## Removed rather than left behind when disabled: the file must not survive from
+   ## an earlier build in the same build slot.
+   ## Copied from the tree, not generated here: a configuration file that only
+   ## exists as a printf inside a build step cannot be read, reviewed or diffed
+   ## where it lives, and its content silently depends on this script's quoting.
+   ## Same 'install --mode' as 20_dist-base-files.cfg above, for the same
+   ## reproducibility reason.
+   ${SUDO_TO_ROOT} safe-rm --force -- "${CHROOT_FOLDER}/etc/default/grub.d/50_dm-smbios-reader.cfg"
    if [ "${dist_build_smbios_reader:-}" = "true" ]; then
       true "${cyan}INFO: --smbios-reader true: enabling the GRUB SMBIOS cmdline reader.${reset}"
-      ${SUDO_TO_ROOT} install --mode=0644 -- "${source_code_folder_dist}/packages/kicksecure/vm-config-dist/usr/share/vm-config-dist/50_dm-smbios-reader.cfg" "${CHROOT_FOLDER}/etc/default/grub.d/50_dm-smbios-reader.cfg"
-   else
-      ${SUDO_TO_ROOT} safe-rm --force -- "${CHROOT_FOLDER}/etc/default/grub.d/50_dm-smbios-reader.cfg"
+      ${SUDO_TO_ROOT} "${cp_reproducible[@]}" "${source_code_folder_dist}/packages/kicksecure/vm-config-dist/usr/share/vm-config-dist/50_dm-smbios-reader.cfg" "${CHROOT_FOLDER}/etc/default/grub.d/50_dm-smbios-reader.cfg"
    fi
 
    ## Debugging.

build-steps.d/3600_convert-raw-to-iso

@@ -64,7 +64,7 @@ create-live-build-image() {
    pushd -- "${dist_live_build_folder}"
 
    ## Avoid errors related to /dev/null when running under Qubes OS
-   if LC_ALL=C mount | grep ' on /home ' | grep -q 'nodev'; then
+   if LC_ALL=C mount | grep ' on /home ' | grep --quiet 'nodev'; then
       ${SUDO_TO_ROOT} mount -o remount,rw,dev /home
    fi
 

build_sources/frozen-snapshot-timestamp

@@ -1 +1 @@
-1787195152
+1787278985

buildconfig.d/25_apt_sources.conf

@@ -215,7 +215,7 @@ if [ "${build_remote_derivative_pkgs:-}" = "true" ]; then
 
    if [ "${sources_list_build_remote_derivative:-}" = "" ]; then
       ## '[signed-by=/usr/share/keyrings/derivative.asc]' is incompatible with build-step create-lb-iso.
-      if printf '%s\n' "$derivative_name_list" | grep -q -i -- "Whonix" ; then
+      if printf '%s\n' "$derivative_name_list" | grep --quiet -i -- "Whonix" ; then
          [ -n "${sources_list_build_remote_derivative:-}" ] || sources_list_build_remote_derivative="
 Types: deb
 URIs: http://127.0.0.1:9977/kicksecure/

ci/dry-run.d/300_run-derivative-maker

@@ -77,7 +77,7 @@ cd -- "$(dirname -- "$(readlink -f -- "${BASH_SOURCE[0]}")")/../.."
 ## 1300, and one real '.deb' built in 1400 -- and a timeout that fires mid-build
 ## reads as a lane failure with no diagnosis. NOT the derivative package set:
 ## 2100_create-debian-packages returns immediately under --dry-run.
-timeout 3600 \
+timeout --kill-after=3600 3600 \
    ./help-steps/run-as-user --chown "${PWD}" -- \
       "${target_user}" \
       env CI=true \

ci/reproducible-build-twice

@@ -45,6 +45,7 @@ set -o pipefail
 set -o errtrace
 shopt -s inherit_errexit
 shopt -s shift_verbose
+export LC_ALL=C
 
 ## style-ok: no-has
 

ci/reproducible-compare

@@ -21,6 +21,7 @@ set -o pipefail
 set -o errtrace
 shopt -s inherit_errexit
 shopt -s shift_verbose
+export LC_ALL=C
 
 true "INFO: Currently running script: ${BASH_SOURCE[0]} $*"