VirtualBox

Ticket #16854 (new defect)

Opened 4 weeks ago

Last modified 4 weeks ago

virtualbox does not build reproducibly

Reported by: bmwiedemann2 Owned by:
Priority: major Component: other
Version: VirtualBox 5.1.22 Keywords:
Cc: Guest type: other
Host type: other

Description

meaning, it creates different results on every build. See  https://reproducible-builds.org/ why that matters.

This comes from multiple sources:

  1. gzip needs to be called with -n (patch attached)
  1. tar does not sort file lists by default (newer version have the --sort=name option but there are other solutions as well)
  1. various .o files contain a 'VTG Object Header v1.7'

added in src/bldprogs/VBoxTpG.cpp:574 via src/VBox/Runtime/generic/RTUuidCreate-generic.cpp RTUuidCreate via src/VBox/Runtime/common/rand/rand.cpp RTRandBytes

IMHO, it would be better to replace that with some digest over source files, so that it changes whenever one of the inputs changes, but remains constant across builds.

Attachments

reproducible.patch Download (2.5 KB) - added by bmwiedemann2 4 weeks ago.
patch to not add timestamps to gz headers

Change History

Changed 4 weeks ago by bmwiedemann2

patch to not add timestamps to gz headers

comment:1 Changed 4 weeks ago by frank

Makes sense, thanks for the hints.

Note: See TracTickets for help on using tickets.

www.oracle.com
ContactPrivacy policyTerms of Use