Re: Deterministic builds

2013-10-02 Thread Steven Chamberlain
On 25/09/13 11:51, Robert Millan wrote: Steven Chamberlain: Maybe we ought to override that when building on non-FreeBSD? $ elfedit --output-osabi=FreeBSD boot/kfreebsd-9.2-1-amd64 Does this work using brandelf (from freebsd-buildutils)? It'd be a lot more mergeable (once upstream codebase

Re: Deterministic builds

2013-09-25 Thread Robert Millan
Steven Chamberlain: Hi, Something we can also do, which I hadn't thought of until now, is to compare kernel images built on kfreebsd-amd64 vs. on linux amd64. An obvious difference is the ELF header: kfreebsd-amd64/boot/kfreebsd-9.2-1-amd64: ELF 64-bit LSB executable, x86-64, version 1

Re: Deterministic builds

2013-09-23 Thread Steven Chamberlain
Hi, Something we can also do, which I hadn't thought of until now, is to compare kernel images built on kfreebsd-amd64 vs. on linux amd64. An obvious difference is the ELF header: kfreebsd-amd64/boot/kfreebsd-9.2-1-amd64: ELF 64-bit LSB executable, x86-64, version 1 (FreeBSD), dynamically

Re: Deterministic builds

2013-09-19 Thread Steven Chamberlain
On 18/09/13 23:02, Robert Millan wrote: Upstream does something similar with svn version number. I suggest you look at newvers.sh, perhaps it can be expanded to support other variables. Thanks. I saw that, and was able to do something similar. The gzipped kernel image now seems to be

Deterministic builds

2013-09-18 Thread Steven Chamberlain
Hi, For our kernels and maybe more, perhaps it would be beneficial to make sure builds are deterministic, or at least, try to produce identical output on every build from the same source. The security rationale is that the build system can be audited this way, by someone else running a build on

Re: Deterministic builds

2013-09-18 Thread Robert Millan
Hi Steven, Steven Chamberlain: For our kernels and maybe more, perhaps it would be beneficial to make sure builds are deterministic, or at least, try to produce identical output on every build from the same source. The security rationale is that the build system can be audited this way,