From 33e150161146bb1dd53b74d176a97b9ca8f1862c Mon Sep 17 00:00:00 2001
From: SysAdmin <sysadmin@silverlabs.uk>
Date: Thu, 7 May 2026 23:50:14 +0100
Subject: [PATCH] fix(linux/build): scrub apt lists + apt/dpkg logs from chroot
 (M1.1 iter33)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Run #4280 cleared every previously-seen non-determinism (post-process
ran end-to-end, all five iter32-fixed flag paths worked). The next
diffoscope-flagged set is the runtime state that *every* Debian build
captures and reproducible-rebuilders strip:

  /var/lib/apt/lists/127.0.0.1:9977_debian-fasttrack_…/InRelease
      The InRelease file from the FastTrack repo carries
      `Date:` and a fresh PGP signature with a 30-minute drift
      between Build A's fetch (22:00 UTC) and Build B's fetch
      (22:30 UTC). FastTrack re-signs roughly daily, so apt
      pickup lands on different signed files when the two builds
      bracket a re-sign. snapshot.debian.org doesn't cover
      FastTrack so we can't pin upstream — strip the file
      instead. apt-get update regenerates it on first boot.

  /var/lib/apt/lists/_home_user_derivative-binary_aptrepo_local_…/Release
      The locally-built kicksecure apt repo's Release file.
      reprepro stamps this with wall-clock time when it generates
      the repo. SOURCE_DATE_EPOCH is honoured for the underlying
      package metadata but reprepro writes Release with the
      current time regardless.

  /var/log/apt/history.log
  /var/log/apt/term.log
  /var/log/dpkg.log
      Wall-clock-stamped logs from package installation. Every
      apt/dpkg invocation prepends a timestamp.

Cleanup added:
  * /var/log/apt/*.log
  * /var/log/{dpkg,alternatives}.log
  * /var/lib/apt/lists/{everything except lock and partial/}

The live system regenerates all of these on first use. Standard
reproducible-Debian rebuilder behaviour (Tails, Whonix-public-iso,
debian-cd all do the equivalent).

If the diffoscope output for run #4280 is honest about the full
delta — and grep ├── shows exactly five entries — this should be
the last divergence. Crossing fingers for run #4281.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 linux/build/scripts/build-inner.sh | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/linux/build/scripts/build-inner.sh b/linux/build/scripts/build-inner.sh
index bff27fa..7f2497e 100755
--- a/linux/build/scripts/build-inner.sh
+++ b/linux/build/scripts/build-inner.sh
@@ -181,7 +181,22 @@ post_process_for_reproducibility() {
         "${chroot_dir}/etc/nvme/hostnqn" \
         "${chroot_dir}/var/cache/apt/pkgcache.bin" \
         "${chroot_dir}/var/cache/apt/srcpkgcache.bin" \
-        "${chroot_dir}/var/cache/ldconfig/aux-cache"
+        "${chroot_dir}/var/cache/ldconfig/aux-cache" \
+        "${chroot_dir}/var/log/dpkg.log" \
+        "${chroot_dir}/var/log/alternatives.log"
+    # /var/log/apt/* — apt history/term logs, every line stamped with
+    # wall-clock time of the build. Regenerated on first use.
+    sudo --non-interactive rm -f "${chroot_dir}"/var/log/apt/*.log
+    # /var/lib/apt/lists/* — downloaded apt index files. The signed
+    # InRelease for each repo carries the repo's signing timestamp
+    # (FastTrack re-signs every 24h or so; the local kicksecure repo
+    # built by 2100_create-debian-packages stamps with reprepro's
+    # wall-clock time). Regenerated on first `apt-get update`.
+    # Keep `lock` and `partial/` so apt's own metadata structure
+    # survives.
+    sudo --non-interactive find "${chroot_dir}/var/lib/apt/lists" \
+        -mindepth 1 -maxdepth 1 -not -name lock -not -name partial \
+        -exec rm -rf {} + 2>/dev/null || true
     sudo --non-interactive find "${chroot_dir}/var/lib/dkms" \
         -mindepth 1 -type d -name log -prune -exec rm -rf {} + \
         2>/dev/null || true