Bug#787795: grub: please build rescue ISO and floppy reproducibly

[Vagrant Cascadian]

On 2015-06-05, Daniel Kahn Gillmor wrote:
> The ISOs (/usr/lib/grub-rescue/grub-rescue-cdrom.iso and
> /usr/lib/grub-rescue/grub-rescue-floppy.iso) that are created by the
> grub build process embed subtle variations in the timestamps and the
> extents of each file.
>
> This is one of the things that keeps the package from producing
> byte-for-byte identical binary builds.

Looking at recent diffoscope output:

  https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/grub2.html

It appears for the .iso files only the timestamp issue remains.


> I think this can be fixed with a couple steps in debian/rules: sort
> the files by extent, and fix the timestamps.  See some of the scripts
> sketched here for example:
>
>    https://lists.gnu.org/archive/html/bug-xorriso/2015-06/msg00013.html
>
> However, it won't be completely reproducible until we get a newer
> version of xorriso in debian so that we can "-alter_date_r c" (see
> #787793, which blocks this bug).

Since newer versions of xorriso are now in Debian, I tried adding
"-alter_date_r c" to xorriso calls, but it would seem xorriso doesn't
support "-alter_date_r c" when used with "-as mkisofs". I'm not sure how
difficult it would be to convert away from using "-as mkisofs" so that
"-alter_date_r c" would be supportable...


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-grub-devel/attachments/20210725/f93e68bc/attachment.sig>