Re: [isar-cip-core][PATCH] Fix file timestamps are not reproducible for EFI certificates

["Kunijadar Shivanand" <Shivanand.Kunijadar@toshiba-tsip.com>]

[-- Attachment #1: Type: text/plain, Size: 2497 bytes --]

On Fri, Sep 18, 2026 at 04:21 AM, Felix Moessbauer wrote:

> 
> On Fri, 2026-09-18 at 13:01 +0200, Jan Kiszka wrote:
> 
>> On 18.09.26 12:54, Moessbauer, Felix (FT RPD CED OES-DE) wrote:
>> 
>>> On Fri, 2026-09-18 at 14:20 +0530, Kunijadar Shivanand wrote:
>>> 
>>>> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
>>>> 
>>>> Closes https://gitlab.com/cip-project/cip-core/isar-cip-core/-/work_items/162
>>>> 
>>>> 
>>>> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
>>>> ---
>>>> .../secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb | 8 +++++++-
>>>> 1 file changed, 7 insertions(+), 1 deletion(-)
>>>> 
>>>> diff --git
>>>> a/recipes-devtools/secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb
>>>> b/recipes-devtools/secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb
>>>> index 263f794..6a5357d 100644
>>>> ---
>>>> a/recipes-devtools/secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb
>>>> +++
>>>> b/recipes-devtools/secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb
>>>> @@ -24,6 +24,12 @@ DPKG_ARCH = "all"
>>>> 
>>>> do_prepare_build() {
>>>> deb_debianize
>>>> + if [ -n "${SOURCE_DATE_EPOCH}" ]; then
>>> 
>>> Good catch! Thanks for debugging this. Please just use
>>> DEBIAN_CHANGELOG_TIMESTAMP instead of the SDE. This variable is always
>>> available and aligns the timestamp of SB parts with the one from the
>>> changelog.
>> 
>> 
> 
> 

Thanks, sent v2 patch to use DEBIAN_CHANGELOG_TIMESTAMP instead of SDE.

> 
> 
>> And simpler code - even better.
>> 
>> Thanks for debugging my bug! :)
> 
> 

Thanks, the v2 patch has a simpler code now, removed condition check.
The recipe is updated to use timestamp option by default.

> 
> While thinking about it, I'm wondering if the timestamp actually has
> security relevance (e.g. for checking the freshness of the DB). I know
> that timestamps in general are pointless in this context, but I'm
> wondering why it can be set in the first place.
> 
> The DEBIAN_CHANGELOG_TIMESTAMP usually is set to 1h after unix epoch
> (for technical reasons 0 cannot be used as this is "magic").
> 
> If we need a proper timestamp here, we should provide a way to set the
> DEBIAN_CHANGELOG_TIMESTAMP just for that package (e.g. by introducing a
> variable).
> 
> But still, the code should use DEBIAN_CHANGELOG_TIMESTAMP to align the
> changelog timestamp with the SB one.
> 
> Felix

Thanks & Regards
Shivanand K

[-- Attachment #2: Type: text/html, Size: 2877 bytes --]