search

Thrilleratplay / coreboot-builder-scripts

Bash scripts and config files to simplify building of Coreboot using the official coreboot-sdk docker image
GNU General Public License v3.0
31 stars 9 forks source link

reproducibility? #3

Closed merge closed 6 years ago

merge commented 6 years ago

I simply cloned the repo 2 times and built, ./build.sh X230. The resuting images differ. diffoscope shows they differ quite significantly. 4 times the build-time is in there, but a large binary chunk difffers too. Why?

thanks.

Thrilleratplay commented 6 years ago

Interesting. I can do the same with just the --clean-slate option. Even though there are git repos used with the payloads, which I should change, even when they are the same commit, there are variations. I will need to investigate this more. Thank you for noticing this.

EDIT: It looks like payloads cause variations. If this is the case, I will add a config that generates a reproducible build and try to match it to the hash generated by Coreboot.

Thrilleratplay commented 6 years ago

This is an example of Coreboot's reproducible build output. The output suggest it is executing the abuild script under coreboot's util directory but, as best as I can determine, uses this config which seems to be missing key information. At this point, I think I need to ask the Coreboot build team about how much of the project is reproducible.

merge commented 6 years ago

Thats a lot for taking the lead on this

Thrilleratplay commented 6 years ago

@merge Just to give you an update, I received a response from the Coreboot mailing list. I need to test removing the secondary payloads and using diffoscope to better determine what is causing variations in checksum hashes.

Thrilleratplay commented 6 years ago

@merge I think the build issue was fixed around a week ago. Using the --bleeding-edge flag, last Saturday and just now I was able to compile Coreboot and generate the same sha256 everytime. Could you try again to confirm this?

merge commented 6 years ago

thanks. will do so during next week.

Am 16. Juni 2018 05:26:55 MESZ schrieb Tom Hiller notifications@github.com:

@merge I think the build issue was fixed around a week ago. Using the --bleeding-edge flag, last Saturday and just now I was able to compile Coreboot and generate the same sha256 everytime. Could you try again to confirm this?

-- Martin Kepplinger http://martinkepplinger.com sent from mobile

merge commented 6 years ago

I can confirm. Nice!

Is there an option to choose one coreboot git commit to build already?

thanks!

merge commented 6 years ago

at least build-tested everything and I'd love to directly include your scripts in the Skulls project...

Thrilleratplay commented 6 years ago

It looks like you found the commit flag and already incorporated many of the same elements of the scripts into Skulls. Please do! I want to focus on using the docker image to build Coreboot and internal flashing. I will point those who need to flash externally to skulls in the readme.

You may want to run Shellcheck across Skulls if you want to make the scripts more cross shell compatible. It also helps with maintaining sanity while writing bash scripts. I tried to make a PR to fix a number of them but kept rewriting the while spaces when I did and never could seem to match the original. I am not sure what editor you use, but to keep that style, you may want to add a editorConfig file to Skulls.