Re: [RFC PATCH] kbuild: Make --build-id linker flag configurable

[Naman Jain]

On 2/2/2026 7:45 PM, Thomas Weißschuh wrote:
> Hi Naman,
>
> On Mon, Feb 02, 2026 at 11:06:31AM +0000, Naman Jain wrote:
> > Build ID hashes include file paths, so building the same source from
> > different directories produces different binaries. This breaks
> > reproducible builds.
> >
> > Add KBUILD_BUILD_ID variable (default: sha1) to allow overriding:
> >
> >      make KBUILD_BUILD_ID=none
> >
> > The variable is exported to VDSO Makefiles which also include a
> > fallback default for standalone invocation.
> >
> > Signed-off-by: Naman Jain <namjain@xxxxxxxxxxxxxxxxxxx>
> > ---
> > Hi,
> > Sending this change for RFC, as it is quite possible that this is a
> > generic problem and I may be missing something.
> >
> > I am trying to implement reproducible builds for one of my product
> > kernel. I referred https://reproducible-builds.org/docs/build-path/
> > and tried to use both -fdebug-prefix-map=OLD=NEW and
> > -fmacro-prefix-map=OLD=NEW, but still could not achieve bit by bit
> > binary reproducibility without overwriting build-id to none.
> > If I move the kernel to same path in other setup, I was able to create
> > same binary hash, however, without it, there is some difference in
> > build-id hash values.

Hi Thomas,
Thanks for looking into this and sharing your inputs.


> Can you force the same build path during package building?
> That should avoid this issue.

Since we can't control where the user would clone their kernel, I was 
initially skeptical to copy the kernel to a same build path like 
/tmp/kernel/src directory due to uncertainties related to free space, 
permissions, but I tried it now and it works fine. It should be OK for 
my use-case.

I am currently using NixOS for reproducible build environment.

> > Reproducibility wiki says "In most cases however, post-processing is
> > required to either remove the build path or to normalize it to a
> > predefined value.". I have tried that, and it works, but wanted to
> > conclude if that is my last option here.
>
> I am not a fan of this aproach. The build id should stay usable.
> Can you figure out where the build paths are used?
> You may need to also compare the debug symbols.
>
> > Thanks.

I agree.
We did not have any use of these build paths, but some vendors may be 
using it to fetch the build information from the binaries.
If your comment was about in-kernel usage of these build paths, I'll 
look into it.

> > ---
> >   Makefile                          | 8 ++++++--
> >   arch/arm64/kernel/vdso/Makefile   | 5 ++++-
> >   arch/arm64/kernel/vdso32/Makefile | 5 ++++-
> >   arch/x86/entry/vdso/Makefile      | 5 ++++-
> >   4 files changed, 18 insertions(+), 5 deletions(-)
> >
> > diff --git a/Makefile b/Makefile
> > index 3373308d2217c..3fcff4af200d7 100644
> > --- a/Makefile
> > +++ b/Makefile
> > @@ -1132,8 +1132,12 @@ KBUILD_AFLAGS   += $(KAFLAGS)
> >   KBUILD_CFLAGS   += $(KCFLAGS)
> >   KBUILD_RUSTFLAGS += $(KRUSTFLAGS)
> >   
> > -KBUILD_LDFLAGS_MODULE += --build-id=sha1
> > -LDFLAGS_vmlinux += --build-id=sha1
> > +# Can be overridden for reproducible builds by using "make KBUILD_BUILD_ID=none"
> > +KBUILD_BUILD_ID ?= sha1
> > +export KBUILD_BUILD_ID
> > +
> > +KBUILD_LDFLAGS_MODULE += --build-id=$(KBUILD_BUILD_ID)
> > +LDFLAGS_vmlinux += --build-id=$(KBUILD_BUILD_ID)
> >   
> >   KBUILD_LDFLAGS	+= -z noexecstack
> >   ifeq ($(CONFIG_LD_IS_BFD),y)
> > diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
> > index 7dec05dd33b70..b3ee5982b4676 100644
> > --- a/arch/arm64/kernel/vdso/Makefile
> > +++ b/arch/arm64/kernel/vdso/Makefile
> > @@ -9,6 +9,9 @@
> >   # Include the generic Makefile to check the built vdso.
> >   include $(srctree)/lib/vdso/Makefile.include
> >   
> > +# Fallback for standalone builds, normally inherited from top-level Makefile
> > +KBUILD_BUILD_ID ?= sha1
> > +
>
> What kind of standalone builds?
> This doesn't look like it belongs into this patch.
>
> (...)

The case I was trying to cover here was when we try to compile 
arch/x86/entry/vdso/ separately, without the KBUILD_BUILD_ID coming from 
main build scripts, "--build-id=" would be left empty, while we may want 
to retain original value i.e. sha1.

    make ARCH=x86_64 arch/x86/entry/vdso/


arch/x86/entry/vdso/Makefile:
-VDSO_LDFLAGS = -shared --hash-style=both --build-id=sha1 --no-undefined \
+VDSO_LDFLAGS = -shared --hash-style=both --build-id=$(KBUILD_BUILD_ID) 
--no-undefined \

Anyways, this may not be required now.

Regards,
Naman