[Reproducible-builds] generating reproducible ISOs with xorriso

[Thomas Schmitt]

Hi,

> If we can identify the specific commands (beyond what you point out
> below), would there a general interest upstream in something like a
> --reproducible=TARGETDATE

The syntax would have to be different and probably a more
comprehensive name will come to us when we know what xorriso
features in particular shall be bundled with the new command.


> It's probably easier to ask grub upstream (and
> other xorriso users) to add a single flag than to add a complex set.

The users will have their own problems to get the new concept
integrated into their ISO production.

The main users within Debian are debian-cd and Debian Live.
One should develop proposals how to make their ISOs reproducible
and how to publish the parameters (e.g. the time stamp) which
they will have to provide to xorriso when reproducing the ISOs.

A special user is grub-mkrescue. We will have to come up with
a well motivated use case to convince Vladimir Serbinenko.


> https://reproducible.debian.net/dbd/unstable/amd64/grub2_2.02~beta2-23.debbindiff.html
> if i'm reading that right, then in
> /usr/lib/grub-rescue/grub-rescue-cdrom.iso, we have
> /BOOT/GRUB/GRUB.CFG;1 with extent 2316 in the first build, and extent 47
> in the second.

Strange ... i had a different model in mind.
Will have to review the source of libisofs (ecma119.c, i guess).

How were the two compared ISOs generated ?
By the same xorriso version and same options resp. commands ?

The sequence of extents can be influenced by the sort weight.
(See man xorrisofs option --sort-weight, man xorriso -find action
 sort_weight.)
Maybe a difference there caused some reshuffle ...


Have a nice day :)

Thomas