Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make SeaBIOS reproducible across different toolchain versions #1121

Open
pietrushnic opened this issue Nov 4, 2024 · 1 comment
Open

Make SeaBIOS reproducible across different toolchain versions #1121

pietrushnic opened this issue Nov 4, 2024 · 1 comment

Comments

@pietrushnic
Copy link

pietrushnic commented Nov 4, 2024

As of version 2024-03-30_cccada28f7, SeaBIOS is sensitive to information about the toolchain, which leads to a lack of reproducibility across toolchain versions (we are talking here coreboot-sdk/dasharo-sdk). The following log comes from building SeaBIOS using two different toolchains.

3107c3122
< #define BUILD_TOOLS "gcc: (coreboot toolchain v2024-03-30_cccada28f7) 13.2.0 binutils: (GNU Binutils) 2.42"
---
> #define BUILD_TOOLS "gcc: (coreboot toolchain v2024-02-18_732134932b) 13.2.0 binutils: (GNU Binutils) 2.41"
@pietrushnic pietrushnic self-assigned this Nov 4, 2024
@pietrushnic pietrushnic changed the title Make SeaBIOS reproducible Make SeaBIOS reproducible across different toolchain versions Nov 14, 2024
@pietrushnic
Copy link
Author

The question is its importance; according to reproducible builds, the number of attributes related to the built environment should be limited. The lack of a reproducible build environment is a significant issue here because we cannot be sure that we will get the same build environment in the future; for now, we are relying on the fact that Dockerhub hosts coreboot-sdk images.

What can we do here?

  • We can limit information about the toolchain to compiler and binutils versions, mentioning this is the coreboot toolchain.
  • We may assume that information about the toolchain version is vital to make binaries reproducible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant