[U-Boot] [Reproducible-builds] [PATCH] build: create time and date independent binary

[Holger Levsen]

Hi Paul,

thanks for contacting us!

On Freitag, 12. Juni 2015, Paul Kocialkowski wrote:
> I think a bit more is needed to get truly reproducible builds in U-Boot,
> but this is a first good step!

you've seen https://reproducible.debian.net/u-boot ?

> I have been thinking about bringing reproducible builds to U-Boot for a
> little while, but never got around actually doing it. Are you interested
> in helping me on that? I have some free time these days, so I could do
> some work on this.

cool!

> It would certainly be relevant to get in touch with the people working
> on reproducing builds for Debian (I know Lunar is involved with this),
> since Debian packages U-Boot for many devices and they're apparently
> willing to help upstream with automated tests, as they're doing with
> coreboot and OpenWRT!

we're definitly happy to help! 

that said, I'm not sure I want to treat uboot like openwrt or coreboot, simply 
because uboot is packaged for several distributions, so (in my maybe naive 
assumptions) it should be tested within those distros.

coreboot is really exceptional here, as it doesn't make much sense to package 
it as part of a distro. (though this could also change, at least sources could 
be shipped...)

but maybe you can explain why u-boot needs more reproducibility testing than 
what there currently is. i'm definitly interested and not opposed, even though 
I think there shoukd be good reasons to treat some software specially.

(also please note that we currently only have amd64 hw to run our tests on.)

In a similar way I have for now decided that I'm not interested in adding 
tests of libreboot, as it's basically just a fork of coreboot, so the 
reproducibility issues should be the same. OTOH libreboot releases images 
(which coreboot doesnt do) so that might become interesting to validate. But 
there I think that the validation should be done as part of that project 
(=libreboot), and not as part of reproducible.debian.net, which I mostly see 
as a.) effort to test and push Debians reproducibility effort and b.) show 
that this is possible for other distros too - but I think in long term that 
should move to a setup located+maintained at those other distros. (because we 
lack the *human*power to look after too/so many things...)

(And really, testing on reproducible.debian.net is not enough, it's just the 
first step: now we know that coreboot is 100% reproducible, now what? This 
"what" needs to happen on the coreboot side...)

So it's not (so much or maybe at all) a question of hardware ressources, which 
we can scale up rather easily, but mostly human ressources maintaining the 
hw+sw *and* translating this into meaningful action for the project tested.

All this said, if you send me patches, I will probably deploy them as I'm very 
curious and more reproducibility efforts are good :-) We can can always decide 
to remove or move them later.


cheers,
	Holger
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 828 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20150613/8d73dec1/attachment.sig>