Reproducibility problems with libcrypto and libtss2 #1616
Description
Please describe the problem
Describe the bug
libcrypto and libtss2 are not reproducible. A build made by two different people on the same revision showed that libcrypto and libtss2 libraries do not have the same hashes (by checking that hashes.txt file after build).
Expected behavior
libcrypto and libtss2 should be reproducible.
Additional context
Checking the affected libraries with diffoscope shows that there are paths and dates included in these libraries. For reference, full diffoscope output is available here (pastebin cannot handle nearly 500k lines file).
Most notable are:
- libcrypto strings:
│ ├── strings --all --bytes=8 {}
│ │ @@ -10042,22 +10042,22 @@
│ │ secure malloc failure
│ │ too many bytes
│ │ too small buffer
│ │ unknown name in random section
│ │ zero length number
│ │ OPENSSL_ia32cap
│ │ %s:%d: OpenSSL internal error: %s
│ │ -built on: Wed Feb 21 13:03:19 2024 UTC
│ │ +built on: Mon Feb 26 11:23:16 2024 UTC
│ │ platform: linux-x86_64
│ │ OPENSSLDIR: "/ssl"
│ │ ENGINESDIR: "//lib64/engines-3"
│ │ MODULESDIR: "//lib64/ossl-modules"
│ │ OpenSSL 3.0.8 7 Feb 2023
│ │ CPUINFO: N/A
│ │ -compiler: /home/michal/Development/Dasharo/heads/crossgcc/x86/bin/x86_64-linux-musl-gcc -fdebug-prefix-map=/home/michal/Development/Dasharo/heads=heads -gno-record-gcc-switches -D__MUSL__ -isystem /home/michal/Development/Dasharo/heads/install/x86/include -L/home/michal/Development/Dasharo/heads/install/x86/lib -fPIC -pthread -m64 -Wa,--noexecstack -Os -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
│ │ +compiler: /home/coreboot/coreboot/crossgcc/x86/bin/x86_64-linux-musl-gcc -fdebug-prefix-map=/home/coreboot/coreboot=heads -gno-record-gcc-switches -D__MUSL__ -isystem /home/coreboot/coreboot/install/x86/include -L/home/coreboot/coreboot/install/x86/lib -fPIC -pthread -m64 -Wa,--noexecstack -Os -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
│ │ crypto/ex_data.c
│ │ CRYPTO_set_ex_data
│ │ CRYPTO_dup_ex_data
│ │ ossl_crypto_new_ex_data_ex
│ │ ossl_crypto_get_ex_new_index_ex
│ │ get_and_lock
│ │ CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llx
- libtss2 strings:
The libs seems to put the full path into the shared object file. Either the prefix is
/home/michal/Development/Dasharo/heads/build/x86/ or /home/coreboot/coreboot/build/x86/. The difference here results from using the same docker image as base environment to build heads, but the parameter for mounting the directory with source was different, i.e. -v $PWD:$PWD vs -v $PWD:/home/coreboot/coreboot.
While the paths are easy to workaround (simply enforce the same mounting paths to docker), these libraries should give the same hashes no matter the paths where they have been built.