Differential D7633
Set PE/COFF timestamps to known value for reproducible builds Authored by emaste on Aug 24 2016, 2:38 PM. Tags None Referenced Files
Details As reported on the freebsd-security mailing list the EFI loader components are identified by freebsd-update builds as having changed on every build. This is due to timestamps embedded in the PE/COFF headers in the EFI files. Use SOURCE_DATE_EPOCH to set the timestamps to a known value, arbitrarily chosen as Fri 1 Jan 2016 00:00:00 UTC. [1] https://lists.freebsd.org/pipermail/freebsd-security/2016-August/009037.html
Diff Detail
Event TimelineComment Actions Add a comment explaining the SOURCE_DATE_EPOCH timestamp based on IRC discussion with @bapt Comment Actions Timestamps can be checked with objdump -p boot1.efi Time/Date Fri Jan 1 00:00:00 2016 I'm not sure how to easily test the end-to-end process with freebsd-update though. Comment Actions sys/conf/newvers.sh also uses SOURCE_DATE_EPOCH, but it allows it to be passed in (via environment?); it only sets SOURCE_DATE_EPOCH explicitly if it's not passed in. For the sake of consistency between parts of the build, shouldn't this do the same thing, and honor SOURCE_DATE_EPOCH if it's already set? Comment Actions Take SOURCE_DATE_EPOCH from the build environment if set, using our arbitrary Jan 1 2016 timestamp if not |