refactor(initramfs): almost make it reproducible (#2569)

If we are using the exact same ublue-os/akmods image and the same inputs
for the initramfs, then it should be stable between builds, make updates
smaller and allow soft-rebooting between deployments (as long as all the
requirements for soft-reboot are met of course).

Thanks secureblue!

xref: https://github.com/ublue-os/aurora/issues/2568

build_scripts/base/19-initramfs.sh

@@ -5,9 +5,32 @@ echo "::group:: ===$(basename "$0")==="
 set -ouex pipefail
 
 KERNEL_VERSION=$(rpm -q --queryformat="%{evr}.%{arch}" kernel-core)
+INITRAMFS="/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
 
-export DRACUT_NO_XATTR=1
-/usr/bin/dracut --kver "${KERNEL_VERSION}" --reproducible -v -f "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
-chmod 0600 "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
+# https://github.com/ublue-os/aurora/issues/2568
+# these strings change with every build
+TMP_OS_RELEASE=$(mktemp --tmpdir 'os-release-XXXXXXXXXX')
+OS_RELEASE="/usr/lib/os-release"
+cp "${OS_RELEASE}" "${TMP_OS_RELEASE}"
+sed -Ei -e '/^((OSTREE_)?(IMAGE_)?VERSION|PRETTY_NAME|BUILD_ID)=/d' "${OS_RELEASE}"
+
+DRACUT_NO_XATTR=1 /usr/bin/dracut \
+  --kver "${KERNEL_VERSION}" \
+  --reproducible \
+  --verbose \
+  --force \
+  "${INITRAMFS}"
+
+# mv causes permissions to change
+cp "${TMP_OS_RELEASE}" "${OS_RELEASE}"
+rm "${TMP_OS_RELEASE}"
+
+chmod 0600 "${INITRAMFS}"
+
+# for reproducibility
+touch -a -m -d "1970-01-01T00:00:00Z" "${INITRAMFS}"
+
+# for debugging
+sha256sum "${INITRAMFS}"
 
 echo "::endgroup::"