Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-05 Thread Thomas Schmitt
Hi, i wrote: > > md5sum [...] seems surplus. Daniel Kahn Gillmor wrote: > Right, but it would seem to fail for hardlinked files or deduped files, > because it would weight one of the files in different places than the > other. Oh. I misunderstood the md5sum part again. It's for the content indee

Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-05 Thread Daniel Kahn Gillmor
Hi Thomas-- Thanks for all your work looking into this! On Fri 2015-06-05 10:57:38 -0400, Thomas Schmitt wrote: > About the --sort-weight-list approach which is possible with > already released xorriso versions: > >> (find . -type f -print0 | xargs -0 md5sum | sort | cut -f2- -d/ ; find . >> -min

Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-05 Thread Thomas Schmitt
Hi, About the --sort-weight-list approach which is possible with already released xorriso versions: > (find . -type f -print0 | xargs -0 md5sum | sort | cut -f2- -d/ ; find . > -mindepth 1 \! -type f | sort | cut -f2- -d/ ) | awk '{ N=N+1; print N " " > $0 }' I misunderstood the role of md5sum h

Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-05 Thread Thomas Schmitt
Hi, > > red-black tree > it makes sense why it is this way, and it also > makes sense why this does not look good for reproducibility. :/ It is slightly overdesigned. :)) A sorted and deduplicated array would do the same. > > Brute force would be a giant weight list > well, -sort-weight-list is

Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-04 Thread Thomas Schmitt
Hi, the current situation with data extents looks not good for the purpose of reproducability. The files are grafted into a red-black tree according to their inode and device numbers on hard disk. This is done to merge hardlinks. The tree is then serialized into an array which gets sorted accordi

Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-04 Thread Daniel Kahn Gillmor
On Thu 2015-06-04 14:08:36 -0400, Thomas Schmitt wrote: > The syntax would have to be different and probably a more > comprehensive name will come to us when we know what xorriso > features in particular shall be bundled with the new command. That seems like a reasonable approach. > The users wil

Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-04 Thread Thomas Schmitt
Hi, > If we can identify the specific commands (beyond what you point out > below), would there a general interest upstream in something like a > --reproducible=TARGETDATE The syntax would have to be different and probably a more comprehensive name will come to us when we know what xorriso featur

Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-04 Thread Daniel Kahn Gillmor
On Thu 2015-06-04 09:53:11 -0400, Thomas Schmitt wrote: > I saw some sin-list page about packages shortly after > xorriso-1.4.0 was released. > It complained about libburn's doc/doxygen.conf.in which i hope to > have fixed by > http://libburnia-project.org/changeset/5446 Thanks! We don't think

Re: [Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-04 Thread Thomas Schmitt
Hi, > I participate in the Debian Reproducible Builds project I saw some sin-list page about packages shortly after xorriso-1.4.0 was released. It complained about libburn's doc/doxygen.conf.in which i hope to have fixed by http://libburnia-project.org/changeset/5446 > I wanted to see if xorr

[Reproducible-builds] generating reproducible ISOs with xorriso

2015-06-04 Thread Daniel Kahn Gillmor
Hi libburnia/xorriso folks-- I participate in the Debian Reproducible Builds project [0] (cc'ed here). Our goal is to ensure that free software can be built from source in a way that the binary outcome is byte-for-byte identical, so that compromised build infrastructure can be detected. One of t