On 03/07/2014 01:32 AM, Arnt Karlsen wrote: > On Thu, 06 Mar 2014 13:03:04 +0100, Kern wrote in message > <[email protected]>: > >> Hello, >> >> I am the project manager for the open source Bacula project, and I >> have been a bit surprised by recent emails talking about checksumming >> binaries. My experience is that you cannot simply apply a checksum >> to a binary and compare it to another binary to determine if the code >> is the same. Having long ago written a linker, this seems to me >> obvious since the compiling and linking process can write out bytes >> that come from uninitialized memory, which means there are certain >> areas of binaries that will be random, unless you have compilers and >> linkers that methodically clear all static memory that is not >> initialized. In addition, although the binary is likely to be >> constructed of the various object files in the same order each time, >> this is not 100% guaranteed especially if a linker uses multiple >> threads to find and pull together the object files needed to build >> the binary. > ..we agree checksumming require more work to come up with a standard > way to prove GPL etc compliance, and we agree "it can not be done > easily right now", and we disagree "on whether it can be done at all." Sorry, I didn't mean to imply that checksums cannot be done, but it will likely be difficult. > > ..and my guess is such a standard way to prove GPL etc compliance in > front of jurors in courts, makes it easier to convince said jurors > that "such and such binaries match that source because the checksums > match the list in the source", than longwinded stories on "how very > difficult and complex it is to checksum 16 Windows binaries right" > in these modern times where computers are supposed to make hard tasks > easy, even for jurors. ;o) I don't recall having said that taking checksums is difficult, since I did it with one script command. Getting meaningfully comparable checksums will probably not be easy.
Yes, I do tend to be longwinded, and to avoid being so again, I will spare you the explanation :-) Perhaps all this was obvious to you, but my main point is that from the standpoint of an open source developer, what I am hearing on this list about checksumming worries me that you are going in a direction that could put more burden on developers not just those who violate the GPL. > >> As a test this morning, I produced 16 Windows binaries as release by >> the Bacula project. They are build on a Linux machine (Ubuntu 12.04) >> using cross-compiling primarily with GNU g++. After producing the >> binaries, I took the "md5sum" of each of the files. I then re-ran the >> exact same build script with no changes made in anything since the >> first binaries and produced a second set of binaries. Not >> surprisingly, the md5sums of the second set of binaries do not match >> those of the first set. >> >> My conclusion is that any attempt to checksum binaries for determining >> if they come from the same source code will be very difficult to get >> right. >> >> Best regards, >> Kern Sibbald >> Bacula Project Manager My email was not meant to discuss my own problems, but since you brought it up, here is my (shortened as much as I can) response. > ..pity, you could have use this in your (secret?) lawsuit on Bareos. Now, that is a very curious comment "secret?". I didn't know there was anything secret about this lawsuit. It is documented on the Bareos website, the bacula.org website, and the Bacula Systems website. The lawsuit is about alleged theft of proprietary code and unfair competition. Bareos also violated the Bacula copyright license, held by the FSFE and after working with the FSFE corrected the most flagrant violations. However, it is my belief that they are still violating the copyright in two senses, one the commercial (not putting the copyright where it should be), two violating basic author's rights. Since I am no longer the copyright owner, I can only act concerning part two: author's rights. My own personal view as an open source project manager is presented at: http://blog.bacula.org Warning, it is longwinded. (this comment not made with any negative intention). Checksums would not be of any use in this case. Best regards, Kern > Maybe Bareos can use this in their defense and countersuit? ;o) > http://www.baculasystems.com/blog/bacula-systems-sa-files-lawsuit-against-bareos-gmbh-co-kg > http://www.bareos.org/en/news/items/lawsuite-between-bacula-systems-sa-and-bareos-gmbh-co-kg-copy.html >
