classes/reproducible_build: Avoid dereferencing symlinks

Using os.path.getmtime() will dereference symbolic links in an attempt
to get the last modified time. This can cause errors if the target
doesn't exist, or worse map to some absolute build host path which would
make a build not reproducible.

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/classes/reproducible_build.bbclass b/meta/classes/reproducible_build.bbclass
index 2df805330aab9c37aa0dafc6c47e8168ab7f6997..268b5fb8f19af2cdff717d61f74e7b5a9eab4e13 100644 (file)
--- a/meta/classes/reproducible_build.bbclass
+++ b/meta/classes/reproducible_build.bbclass
@@ -56,7 +56,7 @@ def get_source_date_epoch_known_files(d, path):
     for file in known_files:
         filepath = os.path.join(path,file)
         if os.path.isfile(filepath):
-            mtime = int(os.path.getmtime(filepath))
+            mtime = int(os.lstat(filepath).st_mtime)
             # There may be more than one "known_file" present, if so, use the youngest one
             if mtime > source_date_epoch:
                 source_date_epoch = mtime
@@ -114,7 +114,7 @@ python do_create_source_date_epoch_stamp() {
             for fname in files:
                 filename = os.path.join(root, fname)
                 try:
-                    mtime = int(os.path.getmtime(filename))
+                    mtime = int(os.lstat(filename).st_mtime)
                 except ValueError:
                     mtime = 0
                 if mtime > source_date_epoch: