| Summary: | libcrypto: improve binary reproducibility | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Juro Bystricky <juro.bystricky> | ||||
| Component: | core | Assignee: | Juro Bystricky <juro.bystricky> | ||||
| Status: | VERIFIED FIXED | QA Contact: | |||||
| Severity: | normal | ||||||
| Priority: | Low | CC: | hongxu.jia, liezhi.yang, meta.mr.watcher, meta.watcher | ||||
| Version: | 2.4 | ||||||
| Target Milestone: | 2.6 | ||||||
| Hardware: | x86 | ||||||
| OS: | Multiple | ||||||
| Whiteboard: | |||||||
| OS type for building Yocto: | --- | Type of Regression: | --- | ||||
| Verified: | Documentation change: | No (bug/feature does not impact docs) | |||||
| Attachments: |
|
||||||
The issue has been fixed by Juro. commit 6c556ed3553d8f5e75d65cd7db92b26df43846b7 Author: Juro Bystricky <juro.bystricky@intel.com> Date: Sat Mar 10 11:27:29 2018 -0800 openssl_1.0.2n: improve reproducibility Improve reproducible build of: openssl-staticdev openssl-dbg libcrypto There are two main causes that prevent reproducible build, both related to the generated file "buildinf.h": 1. "buildinf.h" contains build host CFLAGS, containing various build host references. We need to pass sanitized CFLAGS to the script generating this file ("mkbuildinf.pl". ) 2. We also need to modify the script "mkbuildinf.pl" itsel in order to generate a build timestamp based on SOURCE_DATE_EPOCH, if present in the environment. Signed-off-by: Juro Bystricky <juro.bystricky@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> diffoscope libcrypto1.0.2_1.0.2o-r0_amd64.deb ../a1/libcrypto1.0.2_1.0.2o-r0_amd64.deb --- libcrypto1.0.2_1.0.2o-r0_amd64.deb +++ ../a1/libcrypto1.0.2_1.0.2o-r0_amd64.deb ├── file list │ @@ -1,3 +1,3 @@ │ --rw-r--r-- 0 0 0 4 2018-07-17 08:29:18.000000 debian-binary │ --rw-r--r-- 0 0 0 425 2018-07-17 08:29:18.000000 control.tar.gz │ --rw-r--r-- 0 0 0 835836 2018-07-17 08:29:18.000000 data.tar.xz │ +-rw-r--r-- 0 0 0 4 2018-07-17 08:15:38.000000 debian-binary │ +-rw-r--r-- 0 0 0 424 2018-07-17 08:15:38.000000 control.tar.gz │ +-rw-r--r-- 0 0 0 836080 2018-07-17 08:15:38.000000 data.tar.xz ├── control.tar.gz │ ├── control.tar │ │ ├── file list │ │ │ @@ -1,2 +1,2 @@ │ │ │ -drwxr-xr-x 0 root (0) root (0) 0 2018-07-17 08:29:18.000000 ./ │ │ │ --rw-r--r-- 0 root (0) root (0) 433 2018-07-17 08:29:18.000000 ./control │ │ │ +drwxr-xr-x 0 root (0) root (0) 0 2018-07-17 08:15:38.000000 ./ │ │ │ +-rw-r--r-- 0 root (0) root (0) 433 2018-07-17 08:15:38.000000 ./control ├── data.tar.xz │ ├── data.tar │ │ ├── file list │ │ │ @@ -1,4 +1,4 @@ │ │ │ -drwxrwxrwx 0 root (0) root (0) 0 2018-07-17 08:29:18.000000 ./ │ │ │ -drwxr-xr-x 0 root (0) root (0) 0 2018-07-17 08:29:18.000000 ./usr/ │ │ │ -drwxr-xr-x 0 root (0) root (0) 0 2018-07-17 08:29:18.000000 ./usr/lib/ │ │ │ --rwxr-xr-x 0 root (0) root (0) 2373536 2018-07-17 08:29:18.000000 ./usr/lib/libcrypto.so.1.0.2 │ │ │ +drwxrwxrwx 0 root (0) root (0) 0 2018-07-17 08:15:38.000000 ./ │ │ │ +drwxr-xr-x 0 root (0) root (0) 0 2018-07-17 08:15:38.000000 ./usr/ │ │ │ +drwxr-xr-x 0 root (0) root (0) 0 2018-07-17 08:15:38.000000 ./usr/lib/ │ │ │ +-rwxr-xr-x 0 root (0) root (0) 2373536 2018-07-17 08:15:38.000000 ./usr/lib/libcrypto.so.1.0.2 |
Created attachment 3932 [details] diffoscope output that corroborates the claim. libcrypto needs some patching to achieve binary reproducibility. Note (in the attached diffoscope output) that the host environment ends up in the .rodata section. Hopefully stripping the embedded string "compiler: i586-poky-linux-gcc ..." of all host build references will fix all binary reproducibility issues.