On Thu, 06 Mar 2014 13:03:04 +0100, Kern wrote in message <[email protected]>:
> Hello, > > I am the project manager for the open source Bacula project, and I > have been a bit surprised by recent emails talking about checksumming > binaries. My experience is that you cannot simply apply a checksum > to a binary and compare it to another binary to determine if the code > is the same. Having long ago written a linker, this seems to me > obvious since the compiling and linking process can write out bytes > that come from uninitialized memory, which means there are certain > areas of binaries that will be random, unless you have compilers and > linkers that methodically clear all static memory that is not > initialized. In addition, although the binary is likely to be > constructed of the various object files in the same order each time, > this is not 100% guaranteed especially if a linker uses multiple > threads to find and pull together the object files needed to build > the binary. ..we agree checksumming require more work to come up with a standard way to prove GPL etc compliance, and we agree "it can not be done easily right now", and we disagree "on whether it can be done at all." ..and my guess is such a standard way to prove GPL etc compliance in front of jurors in courts, makes it easier to convince said jurors that "such and such binaries match that source because the checksums match the list in the source", than longwinded stories on "how very difficult and complex it is to checksum 16 Windows binaries right" in these modern times where computers are supposed to make hard tasks easy, even for jurors. ;o) > As a test this morning, I produced 16 Windows binaries as release by > the Bacula project. They are build on a Linux machine (Ubuntu 12.04) > using cross-compiling primarily with GNU g++. After producing the > binaries, I took the "md5sum" of each of the files. I then re-ran the > exact same build script with no changes made in anything since the > first binaries and produced a second set of binaries. Not > surprisingly, the md5sums of the second set of binaries do not match > those of the first set. > > My conclusion is that any attempt to checksum binaries for determining > if they come from the same source code will be very difficult to get > right. > > Best regards, > Kern Sibbald > Bacula Project Manager ..pity, you could have use this in your (secret?) lawsuit on Bareos. Maybe Bareos can use this in their defense and countersuit? ;o) http://www.baculasystems.com/blog/bacula-systems-sa-files-lawsuit-against-bareos-gmbh-co-kg http://www.bareos.org/en/news/items/lawsuite-between-bacula-systems-sa-and-bareos-gmbh-co-kg-copy.html -- ..med vennlig hilsen = with Kind Regards from Arnt Karlsen ...with a number of polar bear hunters in his ancestry... Scenarios always come in sets of three: best case, worst case, and just in case.
