linux-kernel - Re: [PATCH v2] kheaders: making headers archive reproducible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAK7LNARhd7Ogmk8wMnDS9K=jvbBNUAZjkK66U++gGHhWLvgvww@mail.gmail.com>
Date:   Tue, 8 Oct 2019 19:27:35 +0900
From:   Masahiro Yamada <yamada.masahiro@...ionext.com>
To:     Dmitry Goldin <dgoldin@...tonmail.ch>
Cc:     Andreas Schwab <schwab@...ux-m68k.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        "linux-kernel\\\\@vger.kernel.org" <linux-kernel@...r.kernel.org>,
        "joel\\\\@joelfernandes.org" <joel@...lfernandes.org>,
        Ben Hutchings <ben@...adent.org.uk>
Subject: Re: [PATCH v2] kheaders: making headers archive reproducible

On Tue, Oct 8, 2019 at 6:54 PM Dmitry Goldin <dgoldin@...tonmail.ch> wrote:
>
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Tuesday, October 8, 2019 10:14 AM, Masahiro Yamada <yamada.masahiro@...ionext.com> wrote:
>
> > On Tue, Oct 8, 2019 at 5:07 PM Dmitry Goldin dgoldin@...tonmail.ch wrote:
> >
> > > Hmm. --sort was introduced in 1.28 in 2014. Do you think it would warrant some sort of version check and fallback or is this something we can expect the user to handle if their distribution happens to not ship anything more recent? A few sensible workarounds come to mind.
> >
> > I think the former.
>
> After pondering it briefly, maybe substituting the option is a bit less hassle than checking for
> the version and then degrading to a possibly non-reproducible archive.
>
> Maybe we could go with something like the sketch below to replace --sort=name. That is, if
> that's the only problematic flag.
>
> find $cpio_dir -printf "%P\n" | LC_ALL=C sort | \
>     tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
>     --owner=0 --group=0 --numeric-owner \
>     -Jcf $tarfile -C $cpio_dir/ -T - > /dev/null
>
> I will look at this a bit more closely and give it a test-run later today or early tomorrow. Then we can decide if its sufficient before submitting another patch. Other suggestions and pointers are welcome, of course.


I am fine with this solution too.

Thanks!

-- 
Best Regards
Masahiro Yamada