grub-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: consumer of mtime in grub-mkstandalone.c:add_tar_file


From: Andrei Borzenkov
Subject: Re: consumer of mtime in grub-mkstandalone.c:add_tar_file
Date: Fri, 2 Dec 2016 20:38:36 +0300
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0

02.12.2016 17:51, Olaf Hering пишет:
> Who is the consumer of the tar archive generated in util/grub-mkstandalone.c?

It is stored as memory disk inside grub image and $prefix is set to
point to it.

> Why would that consumer need the current mtime of the added file?

Well ... grub itself most likely does not (at least I do not remember
any place where grub would depend on it). OTOH grub-mkstandalone
provides for including of arbitrary files into archive and these files
can be referenced by grub.cfg which also can be added to archive and
contain arbitrary code (and theoretically also out-of-tree modules).

> It breaks what Debian sells as "reproducible builds".
> I think the call to grub_util_get_mtime in add_tar_file should be removed.
> 

I think we could set fake mtime for grub own components (we already fake
it in mkimage - STABLE_EMBEDDING_TIMESTAMP). For any additional file I
would leave it up to user to set desired mtime in advance.

Attachment: signature.asc
Description: OpenPGP digital signature


reply via email to

[Prev in Thread] Current Thread [Next in Thread]