[Buildroot] [PATCH v2 1/2] toolchain/toolchain-wrapper: explicitly set Build ID to none if BR2_REPRODUCIBLE

[Buildroot] [PATCH v2 1/2] toolchain/toolchain-wrapper: explicitly set Build ID to none if BR2_REPRODUCIBLE

[Atharva Lele]

Build ID is added to binaries at link time. Building in different output
directories causes some packages to have different Build IDs, thus resulting in
non-reproducibility.

Adding "-Wl,--build-id=none" fixes this issue by disabling setting of Build ID.

Diffoscope output for Build ID issue: https://gitlab.com/snippets/1886180/raw

After this patch, build is reproducible - i.e. diffoscope does not produce any
output.

Signed-off-by: Atharva Lele <itsatharva@gmail.com>
---
Changes v1 -> v2:
  - Handle inside toolchain-wrapper.mk instead of both .mk and .c
---
 toolchain/toolchain-wrapper.mk | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/toolchain/toolchain-wrapper.mk b/toolchain/toolchain-wrapper.mk
index 970bde76a0..88695a5b2d 100644
--- a/toolchain/toolchain-wrapper.mk
+++ b/toolchain/toolchain-wrapper.mk
@@ -21,6 +21,10 @@ TOOLCHAIN_WRAPPER_OPTS = \
 	$(call qstrip,$(BR2_SSP_OPTION)) \
 	$(call qstrip,$(BR2_TARGET_OPTIMIZATION))
 
+ifeq ($(BR2_REPRODUCIBLE),y)
+TOOLCHAIN_WRAPPER_OPTS += -Wl,--build-id=none
+endif
+
 # We create a list like '"-mfoo", "-mbar", "-mbarfoo"' so that each flag is a
 # separate argument when used in execv() by the toolchain wrapper.
 TOOLCHAIN_WRAPPER_ARGS += \
-- 
2.22.0

[Buildroot] [PATCH v2 2/2] toolchain/toolchain-wrapper: handle __FILE__ macro for reproducibility

[Atharva Lele]

Many tools use __FILE__ for debugging and __FILE__ captures the build path.
This results in non-reproducible images when building in different directories.

If the config uses GCC 8 or above, we use -ffile-prefix-map=old=new and let gcc
take care of the path remapping in __FILE__. Since GCC versions before v8 did
not have this feature, we use a dummy string in that case.

Signed-off-by: Atharva Lele <itsatharva@gmail.com>
---
Changes v2:
  - New patch
---
 toolchain/toolchain-wrapper.mk | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/toolchain/toolchain-wrapper.mk b/toolchain/toolchain-wrapper.mk
index 88695a5b2d..6d0ae2c85b 100644
--- a/toolchain/toolchain-wrapper.mk
+++ b/toolchain/toolchain-wrapper.mk
@@ -23,6 +23,11 @@ TOOLCHAIN_WRAPPER_OPTS = \
 
 ifeq ($(BR2_REPRODUCIBLE),y)
 TOOLCHAIN_WRAPPER_OPTS += -Wl,--build-id=none
+ifeq ($(BR2_TOOLCHAIN_GCC_AT_LEAST_8),y)
+TOOLCHAIN_WRAPPER_OPTS += -ffile-prefix-map=$(BASE_DIR)=buildroot
+else
+TOOLCHAIN_WRAPPER_OPTS += -D__FILE__=\"file-path-replaced-by-buildroot-for-reproducibility\"
+endif
 endif
 
 # We create a list like '"-mfoo", "-mbar", "-mbarfoo"' so that each flag is a
-- 
2.22.0

[Buildroot] [PATCH v2 1/2] toolchain/toolchain-wrapper: explicitly set Build ID to none if BR2_REPRODUCIBLE

[Romain Naour]

Hi Atharva,

Le 31/08/2019 ? 20:01, Atharva Lele a ?crit?:
> Build ID is added to binaries at link time. Building in different output
> directories causes some packages to have different Build IDs, thus resulting in
> non-reproducibility.
> 
> Adding "-Wl,--build-id=none" fixes this issue by disabling setting of Build ID.
> 
> Diffoscope output for Build ID issue: https://gitlab.com/snippets/1886180/raw
> 
> After this patch, build is reproducible - i.e. diffoscope does not produce any
> output.

--build-id option is available in binutils since 2.18 release (from 2007).
(Add a new ELF linker option, --build-id, to generate a unique per-binary
identifier embedded in a note section.) [1]

I don't think there is still toolchain using such old version with an up-to-date
Buildroot tree :)

[1] https://lwn.net/Articles/273637/

Reviewed-by: Romain Naour <romain.naour@smile.fr>

Best regards,
Romain

> 
> Signed-off-by: Atharva Lele <itsatharva@gmail.com>
> ---
> Changes v1 -> v2:
>   - Handle inside toolchain-wrapper.mk instead of both .mk and .c
> ---
>  toolchain/toolchain-wrapper.mk | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/toolchain/toolchain-wrapper.mk b/toolchain/toolchain-wrapper.mk
> index 970bde76a0..88695a5b2d 100644
> --- a/toolchain/toolchain-wrapper.mk
> +++ b/toolchain/toolchain-wrapper.mk
> @@ -21,6 +21,10 @@ TOOLCHAIN_WRAPPER_OPTS = \
>  	$(call qstrip,$(BR2_SSP_OPTION)) \
>  	$(call qstrip,$(BR2_TARGET_OPTIMIZATION))
>  
> +ifeq ($(BR2_REPRODUCIBLE),y)
> +TOOLCHAIN_WRAPPER_OPTS += -Wl,--build-id=none
> +endif
> +
>  # We create a list like '"-mfoo", "-mbar", "-mbarfoo"' so that each flag is a
>  # separate argument when used in execv() by the toolchain wrapper.
>  TOOLCHAIN_WRAPPER_ARGS += \
> 

[Buildroot] [PATCH v2 2/2] toolchain/toolchain-wrapper: handle __FILE__ macro for reproducibility

[Romain Naour]

Hi Atharva,

Le 31/08/2019 ? 20:01, Atharva Lele a ?crit?:
> Many tools use __FILE__ for debugging and __FILE__ captures the build path.
> This results in non-reproducible images when building in different directories.

Based on the commit log in gcc adding this option [1], -ffile-prefix-map also
remap file names in __BASE_FILE__ and __builtin_FILE().

Specifying -ffile-prefix-map option is equivalent to specifying all the
individual options -f*-prefix-map (-fmacro-prefix-map and -fdebug-prefix-map).

[1]
https://github.com/gcc-mirror/gcc/commit/859b51f83662d01e4f158ea9327db9ca37fe70b3

> 
> If the config uses GCC 8 or above, we use -ffile-prefix-map=old=new and let gcc
> take care of the path remapping in __FILE__. Since GCC versions before v8 did
> not have this feature, we use a dummy string in that case.
> 
> Signed-off-by: Atharva Lele <itsatharva@gmail.com>
> ---
> Changes v2:
>   - New patch
> ---
>  toolchain/toolchain-wrapper.mk | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/toolchain/toolchain-wrapper.mk b/toolchain/toolchain-wrapper.mk
> index 88695a5b2d..6d0ae2c85b 100644
> --- a/toolchain/toolchain-wrapper.mk
> +++ b/toolchain/toolchain-wrapper.mk
> @@ -23,6 +23,11 @@ TOOLCHAIN_WRAPPER_OPTS = \
>  
>  ifeq ($(BR2_REPRODUCIBLE),y)
>  TOOLCHAIN_WRAPPER_OPTS += -Wl,--build-id=none
> +ifeq ($(BR2_TOOLCHAIN_GCC_AT_LEAST_8),y)
> +TOOLCHAIN_WRAPPER_OPTS += -ffile-prefix-map=$(BASE_DIR)=buildroot
> +else
> +TOOLCHAIN_WRAPPER_OPTS += -D__FILE__=\"file-path-replaced-by-buildroot-for-reproducibility\"

Maybe __BASE_FILE__ should be handle here too in order to have the save
behaviour as -ffile-prefix-map.
I'm not sure about __builtin_FILE().

Best regards,
Romain

> +endif
>  endif
>  
>  # We create a list like '"-mfoo", "-mbar", "-mbarfoo"' so that each flag is a
> 

[Buildroot] [PATCH v2 2/2] toolchain/toolchain-wrapper: handle __FILE__ macro for reproducibility

[Atharva Lele]

On Sat, Sep 7, 2019 at 8:04 PM Romain Naour <romain.naour@smile.fr> wrote:
>
> Hi Atharva,
>
> Le 31/08/2019 ? 20:01, Atharva Lele a ?crit :
> > Many tools use __FILE__ for debugging and __FILE__ captures the build path.
> > This results in non-reproducible images when building in different directories.
>
> Based on the commit log in gcc adding this option [1], -ffile-prefix-map also
> remap file names in __BASE_FILE__ and __builtin_FILE().
>
> Specifying -ffile-prefix-map option is equivalent to specifying all the
> individual options -f*-prefix-map (-fmacro-prefix-map and -fdebug-prefix-map).
>
> [1]
> https://github.com/gcc-mirror/gcc/commit/859b51f83662d01e4f158ea9327db9ca37fe70b3
>
> >
> > If the config uses GCC 8 or above, we use -ffile-prefix-map=old=new and let gcc
> > take care of the path remapping in __FILE__. Since GCC versions before v8 did
> > not have this feature, we use a dummy string in that case.
> >
> > Signed-off-by: Atharva Lele <itsatharva@gmail.com>
> > ---
> > Changes v2:
> >   - New patch
> > ---
> >  toolchain/toolchain-wrapper.mk | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/toolchain/toolchain-wrapper.mk b/toolchain/toolchain-wrapper.mk
> > index 88695a5b2d..6d0ae2c85b 100644
> > --- a/toolchain/toolchain-wrapper.mk
> > +++ b/toolchain/toolchain-wrapper.mk
> > @@ -23,6 +23,11 @@ TOOLCHAIN_WRAPPER_OPTS = \
> >
> >  ifeq ($(BR2_REPRODUCIBLE),y)
> >  TOOLCHAIN_WRAPPER_OPTS += -Wl,--build-id=none
> > +ifeq ($(BR2_TOOLCHAIN_GCC_AT_LEAST_8),y)
> > +TOOLCHAIN_WRAPPER_OPTS += -ffile-prefix-map=$(BASE_DIR)=buildroot
> > +else
> > +TOOLCHAIN_WRAPPER_OPTS += -D__FILE__=\"file-path-replaced-by-buildroot-for-reproducibility\"
>
> Maybe __BASE_FILE__ should be handle here too in order to have the save
> behaviour as -ffile-prefix-map.

You're right. I will update the patch to handle __BASE__FILE__ as well.

> I'm not sure about __builtin_FILE().

I'm not sure either.. maybe we should keep it as is for now.
Arnout, any thoughts on this?
>
> Best regards,
> Romain
>
> > +endif
> >  endif
> >
> >  # We create a list like '"-mfoo", "-mbar", "-mbarfoo"' so that each flag is a
> >
>


-- 
Regards,
Atharva Lele

[Buildroot] [PATCH v2 2/2] toolchain/toolchain-wrapper: handle __FILE__ macro for reproducibility

[Arnout Vandecappelle]

On 16/09/2019 13:54, Atharva Lele wrote:
[snip]
>> I'm not sure about __builtin_FILE().
> 
> I'm not sure either.. maybe we should keep it as is for now.
> Arnout, any thoughts on this?

 There's no way to handle __builtin_FILE() correctly, because it's defined as a
function, not a macro. However, we already don't handle __FILE__ correctly
(since it should contain the actual file name, and not just a constant), so I
guess doing something like -D__builtin_FILE()=\"...\" should work.

 BTW, now I think a bit more about this... The __FILE__ macro (and related) are
used in 99% of the cases for debugging and logging output. Putting
'file-path-replaced-by-buildroot-for-reproducibility' there is hardly helpful.
Maybe it would be better to just put the empty string. Romain, what do you think?

 Regards,
 Arnout

[Buildroot] [PATCH v2 1/2] toolchain/toolchain-wrapper: explicitly set Build ID to none if BR2_REPRODUCIBLE

[Thomas Petazzoni]

On Sat, 31 Aug 2019 23:31:12 +0530
Atharva Lele <itsatharva@gmail.com> wrote:

> Build ID is added to binaries at link time. Building in different output
> directories causes some packages to have different Build IDs, thus resulting in
> non-reproducibility.
> 
> Adding "-Wl,--build-id=none" fixes this issue by disabling setting of Build ID.
> 
> Diffoscope output for Build ID issue: https://gitlab.com/snippets/1886180/raw
> 
> After this patch, build is reproducible - i.e. diffoscope does not produce any
> output.
> 
> Signed-off-by: Atharva Lele <itsatharva@gmail.com>
> ---
> Changes v1 -> v2:
>   - Handle inside toolchain-wrapper.mk instead of both .mk and .c
> ---
>  toolchain/toolchain-wrapper.mk | 4 ++++
>  1 file changed, 4 insertions(+)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[Buildroot] [PATCH v2 2/2] toolchain/toolchain-wrapper: handle __FILE__ macro for reproducibility

[Thomas Petazzoni]

Hello,

On Sat, 31 Aug 2019 23:31:13 +0530
Atharva Lele <itsatharva@gmail.com> wrote:

> Many tools use __FILE__ for debugging and __FILE__ captures the build path.
> This results in non-reproducible images when building in different directories.
> 
> If the config uses GCC 8 or above, we use -ffile-prefix-map=old=new and let gcc
> take care of the path remapping in __FILE__. Since GCC versions before v8 did
> not have this feature, we use a dummy string in that case.
> 
> Signed-off-by: Atharva Lele <itsatharva@gmail.com>

I have applied this patch, with the following changes:

    [Thomas:
     - as suggested by Arnout, use the empty string for the __FILE__ and
       __BASE_FILE__ value
     - as suggested by Romain, also handle __BASE_FILE__ in addition to
       __FILE__
     - pass -Wno-builtin-macro-redefined to avoid build errors when
       -Werror is passed]

Best regards,

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com