more stage1 cleanup/hacks

src/bootstrap/stage1/Containerfile

@@ -256,6 +256,7 @@ ADD --checksum=sha256:f4a245b94124b377d8b49646bf421f9155d36aa7614b6ebf83705d3ffc
 ADD --checksum=sha256:dd172acb53867a68012f94c17389401b2f274a1aa5ae8f84cbfb8b7e383ea8d3 http://ixpeering.dl.sourceforge.net/project/lzmautils/xz-5.4.1.tar.bz2 ./
 ADD --checksum=sha256:b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30 https://zlib.net/fossils/zlib-1.2.13.tar.gz ./
 
+# HACK: stage0 tar is currently incompatible with symlinks and github tgz files
 #FROM base as extract
 #COPY --from=stagex/stage0 . /
 #COPY --from=fetch distfiles/live-bootstrap.tgz .
@@ -268,14 +269,11 @@ ADD --checksum=sha256:b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f8
 #	echo "" > lrvick-live-bootstrap-fc6eeb6/steps/lwext4-1.0.0-lb1/files/fiwix-file-list.txt
 #EOF
 #RUN --network=none ./extract.kaem
-
-# temporary hack as above tar is incompatible with symliks and github tgz files
 FROM debian@sha256:bac353db4cc04bc672b14029964e686cd7bad56fe34b51f432c1a1304b9928da as extract
 COPY --from=fetch distfiles/live-bootstrap.tgz .
-RUN <<-EOF
-	tar -xvf live-bootstrap.tgz
-	echo "" > lrvick-live-bootstrap-fc6eeb6/steps/lwext4-1.0.0-lb1/files/fiwix-file-list.txt
-EOF
+RUN --network=none tar -xvf live-bootstrap.tgz
+# HACK: fixed in live-bootstrap upstream and can be dropped on next source bump
+RUN echo "" > lrvick-live-bootstrap-fc6eeb6/steps/lwext4-1.0.0-lb1/files/fiwix-file-list.txt
 
 FROM base as build
 USER 0:0
@@ -313,12 +311,22 @@ COPY <<-EOF install.kaem
     cp -R lib usr bin var etc /rootfs/
     rm /rootfs/etc/hosts
     rm /rootfs/etc/resolv.conf
+    # HACK: This has been fixed upstream and can be dropped on next source bump
+    rm -rf /usr/lib/python*/__pycache__;
 EOF
 SHELL ["/x86/bin/kaem","--verbose","--strict","--file"]
 RUN --network=none ./install.kaem
 
+# HACK: Zero out timestamps
+# We can drop this when either of the following happens:
+# - buildkit 0.13+ w/ "rewrite-timestamps=true" feature ships in stable Docker
+# - a "find/touch" tool ships with stage0
+FROM debian@sha256:bac353db4cc04bc672b14029964e686cd7bad56fe34b51f432c1a1304b9928da as touch
+COPY --from=install /rootfs /rootfs
+RUN --network=none find /rootfs -exec touch -hcd "@0" "{}" +
+
 FROM scratch as package
-COPY --from=install /rootfs /
+COPY --from=touch /rootfs /
 USER 1000:1000
 ENTRYPOINT ["/bin/bash"]
 ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

src/core/musl/Containerfile

@@ -1,47 +1,50 @@
-FROM stagex/stage3 as base
-ENV SRC_SITE http://musl.libc.org
-ENV SRC_VERSION 1.2.4
+FROM scratch as base
+ARG ARCH=x86_64
+ENV VERSION 1.2.4
+ENV SRC_FILE musl-${VERSION}.tar.gz
+ENV SRC_SITE http://musl.libc.org/${SRC_FILE}
 ENV SRC_HASH 7a35eae33d5372a7c0da1188de798726f68825513b7ae3ebe97aaaa52114f039
 ENV CFLAGS="-Os -fstack-clash-protection -Wformat -Werror=format-security"
 ENV CXXFLAGS="-Os -fstack-clash-protection -Wformat -Werror=format-security -D_GLIBCXX_ASSERTIONS=1 -D_LIBCPP_ENABLE_THREAD_SAFETY_ANNOTATIONS=1 -D_LIBCPP_ENABLE_HARDENED_MODE=1"
 ENV LDFLAGS="-Wl,--as-needed,-O1,--sort-common -Wl,-soname,libc.musl-${ARCH}.so.1"
 
 FROM base as fetch
-WORKDIR ${HOME}
-RUN wget ${SRC_SITE}/releases/musl-$SRC_VERSION.tar.gz
-RUN echo "${SRC_HASH}  musl-${SRC_VERSION}.tar.gz" | sha256sum -c
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
 FROM fetch as build
-RUN tar -xzf musl-${SRC_VERSION}.tar.gz
-WORKDIR musl-${SRC_VERSION}
+COPY --from=stagex/stage3 . /
+RUN tar -xzf ${SRC_FILE}
+WORKDIR musl-${VERSION}
 ADD *.patch .
-RUN set -eux; \
-    patch -p1 < lfs64.patch; \
-    patch -p1 < lfs64-2.patch; \
-    patch -p1 < relr-typedefs.patch; \
-    ./configure \
-        --build=${ARCH}-linux-musl \
-        --host=${ARCH}-linux-musl \
-        --prefix=/usr \
-        --sysconfdir=/etc \
-        --mandir=/usr/share/man \
-        --infodir=/usr/share/info \
-        --localstatedir=/var \
-        --enable-debug; \
-    make
+RUN --network=none <<-EOF
+	set -eux; \
+	patch -p1 < lfs64.patch
+	patch -p1 < lfs64-2.patch
+	patch -p1 < relr-typedefs.patch
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--localstatedir=/var \
+		--enable-debug
+	make
+EOF
 
 FROM build as install
-USER 0:0
-RUN set -eux; \
-    make DESTDIR=/rootfs install; \
-    mkdir -p /rootfs/usr/bin; \
-    printf "%s\n%s\n" '#!/bin/sh' 'exec /lib/ld-musl-${ARCH}.so.1 --list "$@"' \
-        > /rootfs/usr/bin/ldd; \
-    chmod 755 /rootfs/usr/bin/ldd; \
-    mv -f /rootfs/usr/lib/libc.so /rootfs/lib/ld-musl-${ARCH}.so.1; \
-    ln -sf ld-musl-${ARCH}.so.1 /rootfs/lib/libc.musl-${ARCH}.so.1; \
-    ln -sf ../../lib/ld-musl-${ARCH}.so.1 /rootfs/usr/lib/libc.so; \
-    find /rootfs -exec touch -hcd "@0" "{}" +
+RUN --network=none <<-EOF
+	set -eux
+	make DESTDIR=/rootfs install
+	mkdir -p /rootfs/usr/bin
+	printf "%s\n%s\n" '#!/bin/sh' 'exec /lib/ld-musl-${ARCH}.so.1 --list "$@"' \
+		> /rootfs/usr/bin/ldd; \
+	chmod 755 /rootfs/usr/bin/ldd
+	mv -f /rootfs/usr/lib/libc.so /rootfs/lib/ld-musl-${ARCH}.so.1
+	ln -sf ld-musl-${ARCH}.so.1 /rootfs/lib/libc.musl-${ARCH}.so.1
+	ln -sf ../../lib/ld-musl-${ARCH}.so.1 /rootfs/usr/lib/libc.so
+EOF
 
 FROM scratch as package
 COPY --from=install /rootfs /

src/macros.mk

@@ -36,6 +36,7 @@ define build
 			build \
 			--ulimit nofile=2048:16384 \
 			--tag $(REGISTRY)/$(NAME):$(VERSION) \
+			--build-arg SOURCE_DATE_EPOCH=1 \
 			--build-arg REGISTRY=$(REGISTRY) \
 			--build-arg CORES=$(shell nproc --all) \
 			--platform $(PLATFORM) \