unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
To: Guix Devel <guix-devel@gnu.org>
Subject: maradns reproducibility fixes and the merits of picking a random number
Date: Mon, 06 Jun 2022 18:49:34 -0700	[thread overview]
Message-ID: <87pmjlfdjl.fsf@contorta> (raw)

[-- Attachment #1: Type: text/plain, Size: 5664 bytes --]

So, I've got a fix for the reproducibility issues for maradns... part of
the fixes are fairly obvious, setting a specific date and setting the
version to be, well, the version...

But there's one nervous-making issue this revealed; maradns embeds a
random number at build time ... allegedly for systems that don't have
/dev/urandom... see
maradns-3.5.0020/deadwood-3.5.0020/src/Makefile.ubuntu2004:

  # Since some systems may not have /dev/urandom (Windows, *cough* *cough*), we
  # keep a randomly generated prime around

So it's got some code to generate a random number at build time and
embed it in the binary. Now, if there's anything I know about good
practices about random numbers, this sort of thing is generally a very
large red flag! It also makes the package build differently every time!

So, Debian's maradns package just removes this embedding of a "random"
number, and I've basically adapted their patches to build reproducibly
on guix too... by basically embedding the same "random" number every
single build!

That said, hopefully it actually uses /dev/urandom and this is just a
fallback for when /dev/urandom is missing? Is that actually how this is
supposed to work? Is that actually how the code does work? If that's the
case, I think the following patch should work ok on Guix.

But I wanted some extra eyes on this before pushing...

live well,
  vagrant

p.s. Obviously, I picked the best random number.

From a2e10d39de37c363b25f06dbb275e2bf6d614b7c Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Sun, 5 Jun 2022 13:57:27 -0700
Subject: [PATCH 3/3] gnu: maradns: Build reproducibly.

* gnu/packages/patches/maradns-deadwood-do-not-embed-random-number.patch: New
  file.
* gnu/local.mk (dist_patch_DATA): Add patch.
* gnu/package/dns.scm (maradns)[source]: Add patch.
  [arguments]: Pass VERSION and COMPILED via makeflags.
---
 gnu/local.mk                                  |  1 +
 gnu/packages/dns.scm                          |  7 +++-
 ...-deadwood-do-not-embed-random-number.patch | 38 +++++++++++++++++++
 3 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/maradns-deadwood-do-not-embed-random-number.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 68b317b32a..ff1135e48e 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1471,6 +1471,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/lvm2-static-link.patch			\
   %D%/packages/patches/mailutils-variable-lookup.patch		\
   %D%/packages/patches/make-impure-dirs.patch			\
+  %D%/packages/patches/maradns-deadwood-do-not-embed-random-number.patch	\
   %D%/packages/patches/mariadb-link-libatomic.patch		\
   %D%/packages/patches/mars-install.patch			\
   %D%/packages/patches/mars-sfml-2.3.patch			\
diff --git a/gnu/packages/dns.scm b/gnu/packages/dns.scm
index fea255c930..39268ddfcf 100644
--- a/gnu/packages/dns.scm
+++ b/gnu/packages/dns.scm
@@ -1302,7 +1302,10 @@ (define-public maradns
                            (version-major+minor version) "/"
                            version "/maradns-" version ".tar.xz"))
        (sha256
-        (base32 "1qgabw6y2bwy6y88dikis62k789i0xh7iwxan8jmqpzvksqwjfgw"))))
+        (base32 "1qgabw6y2bwy6y88dikis62k789i0xh7iwxan8jmqpzvksqwjfgw"))
+       (patches
+        (search-patches
+         "maradns-deadwood-do-not-embed-random-number.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f                      ; need to be root to run tests
@@ -1310,6 +1313,8 @@ (define-public maradns
        (list
         ,(string-append "CC=" (cc-for-target))
         (string-append "PREFIX=" %output)
+        (string-append "COMPILED=" "2012-04-18")
+        (string-append "VERSION=" ,version)
         (string-append "RPM_BUILD_ROOT=" %output))
        #:phases
        (modify-phases %standard-phases
diff --git a/gnu/packages/patches/maradns-deadwood-do-not-embed-random-number.patch b/gnu/packages/patches/maradns-deadwood-do-not-embed-random-number.patch
new file mode 100644
index 0000000000..7e51e79259
--- /dev/null
+++ b/gnu/packages/patches/maradns-deadwood-do-not-embed-random-number.patch
@@ -0,0 +1,38 @@
+Adapted from https://sources.debian.org/src/maradns/2.0.13-1.4/debian/patches/deadwood_makefile.patch/
+
+diff --git a/deadwood-3.5.0020/src/Makefile.ubuntu2004 b/deadwood-3.5.0020/src/Makefile.ubuntu2004
+index 62868aa..2c8c094 100644
+--- a/deadwood-3.5.0020/src/Makefile.ubuntu2004
++++ b/deadwood-3.5.0020/src/Makefile.ubuntu2004
+@@ -29,13 +29,10 @@ all:	Deadwood version.h
+ #
+ 
+ clean:
+-	rm -f Test DwMain DwTcp *.exe *.o a.out RandomPrime writehash_test* \
+-		Deadwood foo* dw_cache DwHash DwCompress *stackdump \
+-		core ; \
+-		./make.version.h ; if [ -e /dev/urandom ] ; \
+-			then rm DwRandPrime.h  ; \
+-			cc RandomPrime.c ; ./a.out > DwRandPrime.h ; rm a.out \
+-		; fi 
++	rm -f Test DwMain DwTcp *.exe *.o a.out writehash_test* \
++		Deadwood foo* dw_cache DwHash DwCompress *stackdump core
++
++
+ 
+ version.h:	
+ 	./make.version.h
+@@ -67,11 +64,8 @@ DwSocket.o:	DwSocket.c DwStr.h DwSocket.h
+ DwSys.o:	DwSys.c DwStr.h version.h
+ 	$(CC) $(FLAGS) -Wall -c -o DwSys.o DwSys.c
+ 
+-RandomPrime:	RandomPrime.c
+-	$(CC) -O3 -o RandomPrime RandomPrime.c
+-
+-DwRandPrime.h: RandomPrime
+-	if [ -e /dev/urandom ] ; then ./RandomPrime > DwRandPrime.h ; fi
++DwRandPrime.h:
++	echo '#define MUL_CONSTANT 1238145941' > DwRandPrime.h
+ 
+ DwHash.o:	DwHash.c DwStr.h DwRandPrime.h DwHash.h
+ 	$(CC) $(FLAGS) -Wall -c -o DwHash.o DwHash.c
-- 
2.35.1


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

             reply	other threads:[~2022-06-07  1:50 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-07  1:49 Vagrant Cascadian [this message]
2022-06-07  3:24 ` maradns reproducibility fixes and the merits of picking a random number Felix Lechner
2022-06-07  5:20   ` Julien Lepiller
2022-06-07 12:11     ` Brian Cully via Development of GNU Guix and the GNU System distribution.
2022-06-08 11:48       ` Efraim Flashner
2022-06-08 14:09         ` Tobias Geerinckx-Rice
2022-06-08 11:47     ` Efraim Flashner
2022-06-08 20:33       ` Vagrant Cascadian
2022-06-23  2:05         ` Vagrant Cascadian
2022-06-28  1:31           ` Vagrant Cascadian
2022-06-28  9:30             ` Efraim Flashner
2022-06-28 15:39               ` Jack Hill
2022-06-28 16:04               ` Tobias Geerinckx-Rice
2022-06-28 16:18                 ` Gábor Boskovits
2022-06-28 16:33                   ` Vagrant Cascadian
2022-06-28 19:06                     ` Tobias Geerinckx-Rice
2022-06-28 19:15                       ` Tobias Geerinckx-Rice
2022-07-12  2:36                       ` Vagrant Cascadian
2022-07-12  2:41                         ` Vagrant Cascadian
2022-07-18 11:21                           ` Ludovic Courtès
2022-07-19 13:09                             ` Tobias Geerinckx-Rice
2022-06-07 15:15 ` Ludovic Courtès
2022-06-08 19:28 ` Arun Isaac
2022-06-08 20:25   ` Vagrant Cascadian
2022-06-14 17:16     ` Philip McGrath
2022-06-08 19:43 ` Liliana Marie Prikler
2022-06-08 20:23   ` Vagrant Cascadian

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87pmjlfdjl.fsf@contorta \
    --to=vagrant@reproducible-builds.org \
    --cc=guix-devel@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).