consumer of mtime in grub-mkstandalone.c:add_tar_file

consumer of mtime in grub-mkstandalone.c:add_tar_file

[Olaf Hering]

[-- Attachment #1: Type: text/plain, Size: 279 bytes --]

Who is the consumer of the tar archive generated in util/grub-mkstandalone.c?
Why would that consumer need the current mtime of the added file?
It breaks what Debian sells as "reproducible builds".
I think the call to grub_util_get_mtime in add_tar_file should be removed.

Olaf

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: consumer of mtime in grub-mkstandalone.c:add_tar_file

[Andrei Borzenkov]

[-- Attachment #1.1: Type: text/plain, Size: 982 bytes --]

02.12.2016 17:51, Olaf Hering пишет:
> Who is the consumer of the tar archive generated in util/grub-mkstandalone.c?

It is stored as memory disk inside grub image and $prefix is set to
point to it.

> Why would that consumer need the current mtime of the added file?

Well ... grub itself most likely does not (at least I do not remember
any place where grub would depend on it). OTOH grub-mkstandalone
provides for including of arbitrary files into archive and these files
can be referenced by grub.cfg which also can be added to archive and
contain arbitrary code (and theoretically also out-of-tree modules).

> It breaks what Debian sells as "reproducible builds".
> I think the call to grub_util_get_mtime in add_tar_file should be removed.
> 

I think we could set fake mtime for grub own components (we already fake
it in mkimage - STABLE_EMBEDDING_TIMESTAMP). For any additional file I
would leave it up to user to set desired mtime in advance.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: consumer of mtime in grub-mkstandalone.c:add_tar_file

[Vladimir 'phcoder' Serbinenko]

[-- Attachment #1: Type: text/plain, Size: 1516 bytes --]

By default grub doesn't care about mtime but you can use -nt syntax in test
command. This is useful to e.g. find the newest kernel. This being said,
it's fine to have an override flag or environment variable to change the
mtime to some fixed value

Le ven. 2 déc. 2016 09:39, Andrei Borzenkov <arvidjaar@gmail.com> a écrit :

> 02.12.2016 17:51, Olaf Hering пишет:
> > Who is the consumer of the tar archive generated in
> util/grub-mkstandalone.c?
>
> It is stored as memory disk inside grub image and $prefix is set to
> point to it.
>
> > Why would that consumer need the current mtime of the added file?
>
> Well ... grub itself most likely does not (at least I do not remember
> any place where grub would depend on it). OTOH grub-mkstandalone
> provides for including of arbitrary files into archive and these files
> can be referenced by grub.cfg which also can be added to archive and
> contain arbitrary code (and theoretically also out-of-tree modules).
>
> > It breaks what Debian sells as "reproducible builds".
> > I think the call to grub_util_get_mtime in add_tar_file should be
> removed.
> >
>
> I think we could set fake mtime for grub own components (we already fake
> it in mkimage - STABLE_EMBEDDING_TIMESTAMP). For any additional file I
> would leave it up to user to set desired mtime in advance.
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
>

[-- Attachment #2: Type: text/html, Size: 2473 bytes --]