feat: reproducible builds

.github/workflows/release.yml

@@ -39,10 +39,9 @@ jobs:
         run: |
           sed 's/ghcr.io\/vanilla-os\/core:dev/ghcr.io\/vanilla-os\/core:main/' -i recipe.yml
 
-      - uses: vanilla-os/vib-gh-action@v1.0.6
+      - uses: vanilla-os/vib-gh-action@v1.1.0
         with:
             recipe: 'recipe.yml'
-            plugins: 'Vanilla-OS/vib-fsguard:v1.6.1'
 
       - uses: actions/upload-artifact@v7
         with:

.github/workflows/vib-build.yml

@@ -48,10 +48,9 @@ jobs:
       run: |
         sed 's/ghcr.io\/vanilla-os\/core:dev/ghcr.io\/vanilla-os\/core:main/' -i recipe.yml
 
-    - uses: vanilla-os/vib-gh-action@v1.0.6
+    - uses: vanilla-os/vib-gh-action@v1.1.0
       with:
         recipe: 'recipe.yml'
-        plugins: 'Vanilla-OS/vib-fsguard:v1.6.1'
 
     - uses: actions/upload-artifact@v7
       with:
@@ -70,6 +69,7 @@ jobs:
       uses: docker/metadata-action@v5
       with:
         images: ${{ env.IMAGE_URL }}
+        labels: org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}}
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -82,6 +82,9 @@ jobs:
         username: ${{ github.repository_owner }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Get Git commit timestamps
+      run: echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
+
     - name: Build and push by digest
       id: build
       uses: docker/build-push-action@v6
@@ -94,7 +97,9 @@ jobs:
         cache-to: type=gha,mode=max
         platforms: linux/${{ matrix.arch }}
         provenance: false
-        outputs: type=image,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
+        outputs: type=image,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }},rewrite-timestamp=true
+      env:
+        SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
 
     - name: Attest pushed image
       uses: actions/attest-build-provenance@v4

README.md

@@ -7,9 +7,6 @@ Vanilla OS Desktop experience with GNOME.
 
 ## Build
 
-> [!NOTE]
-> The fsguard compiled plugin `.so` file should be downloaded from the [latest release](https://github.com/Vanilla-OS/vib-fsguard/releases/latest) and be placed under a `plugins` directory beside the `recipe.yml` file.
-
 ```bash
 vib build recipe.yml
 podman image build -t vanillaos/desktop .

modules/80-printers.yml

@@ -14,3 +14,6 @@ sources:
     # Config
     - system-config-printer-common
     - system-config-printer-udev
+cleanup:
+  - /etc/ssl/certs/ssl-cert-snakeoil.pem
+  - /etc/ssl/private/ssl-cert-snakeoil.key

recipe.yml

@@ -1,6 +1,6 @@
 name: Vanilla Desktop
 id: desktop
-vibversion: 1.0.6
+vibversion: 1.1.0
 
 stages:
 - id: build
@@ -14,6 +14,17 @@ stages:
   runs:
     commands:
       - echo 'APT::Install-Recommends "1";' > /etc/apt/apt.conf.d/01norecommends
+  cleanup:
+    - /boot/initrd.img*
+    - /tmp/*
+    - /var/cache/apt/pkgcache.bin
+    - /var/cache/debconf
+    - /var/cache/dictionaries-common
+    - /var/cache/fontconfig
+    - /var/cache/ldconfig
+    - /var/cache/man
+    - /var/lib/dbus/machine-id
+    - /var/log/*
 
   modules:
   - name: init-setup
@@ -86,23 +97,11 @@ stages:
     - apt clean
     - lpkg --lock
     - rsync -a /etc/ /sysconf/
+    cleanup:
+    - /sysconf/resolv.conf
 
-  - name: fsguard
-    type: fsguard
-    CustomFsGuard: false
-    FsGuardLocation: "/usr/sbin/FsGuard"
-    GenerateKey: true
-    FilelistPaths: ["/usr/bin"]
-    modules:
-      - name: remove-prev-fsguard
-        type: shell
-        commands:
-          - rm -rf /FsGuard
-          - rm -f ./minisign.pub ./minisign.key
-          - chmod +x /usr/share/init.d/010-fsguard.sh
-
-  - name: cleanup2
-    type: shell
+- id: initrd
+  base: build
+  runs:
     commands:
-      - rm -rf /tmp/*
-      - rm -rf /var/tmp/*
+      - touch $(readlink -f /initrd.img)