linux-kernel - Re: [PATCH v2] kheaders: making headers archive reproducible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 08 Oct 2019 09:54:43 +0000
From:   Dmitry Goldin <dgoldin@...tonmail.ch>
To:     Masahiro Yamada <yamada.masahiro@...ionext.com>
Cc:     Andreas Schwab <schwab@...ux-m68k.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        "linux-kernel\\\\@vger.kernel.org" <linux-kernel@...r.kernel.org>,
        "joel\\\\@joelfernandes.org" <joel@...lfernandes.org>,
        Ben Hutchings <ben@...adent.org.uk>
Subject: Re: [PATCH v2] kheaders: making headers archive reproducible

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday, October 8, 2019 10:14 AM, Masahiro Yamada <yamada.masahiro@...ionext.com> wrote:

> On Tue, Oct 8, 2019 at 5:07 PM Dmitry Goldin dgoldin@...tonmail.ch wrote:
>
> > Hmm. --sort was introduced in 1.28 in 2014. Do you think it would warrant some sort of version check and fallback or is this something we can expect the user to handle if their distribution happens to not ship anything more recent? A few sensible workarounds come to mind.
>
> I think the former.

After pondering it briefly, maybe substituting the option is a bit less hassle than checking for
the version and then degrading to a possibly non-reproducible archive.

Maybe we could go with something like the sketch below to replace --sort=name. That is, if
that's the only problematic flag.

find $cpio_dir -printf "%P\n" | LC_ALL=C sort | \
    tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
    --owner=0 --group=0 --numeric-owner \
    -Jcf $tarfile -C $cpio_dir/ -T - > /dev/null

I will look at this a bit more closely and give it a test-run later today or early tomorrow. Then we can decide if its sufficient before submitting another patch. Other suggestions and pointers are welcome, of course.

--
Best regards,
    Dmitry