Re: Reproducible Builds for Fedora

[Nicolas Vigier <boklm () mars-attacks org>]

On Wed, 25 Sep 2013, Steve Grubb wrote:

> Hello,
>
> On Wednesday, September 25, 2013 10:08:01 AM Sebastian Krahmer wrote:
> > I was checking the rpm-compare how it actually is doing the compre
> > and you have:
> >
> > [...]
> >                 base=`basename $f`
> >                 objdump -d rpm1/$f | grep -v $base > dump1
> >                 objdump -d rpm2/$f | grep -v $base > dump2
> >                 diff -u dump1 dump2 > /dev/null
> >                 if [ $? -ne 0 ] ; then
> >                           echo "File disassembly differs $f"
> >                           cnt=`expr $cnt + 1`
> >                 fi
> > [...]
> >
> > for ELF files and doing a sha256sum for other file types. My concern is
> > that attackers could construct a package that contains function-names that
> > match the basename of the binary that you are checking.
>
> Thanks for the feedback. I think the 'grep -v' can be replaced with sed 
> '1,2d'. Its purpose was to delete the file path that objdump inserts at the top 
> which causes miscompares.

Or something like this ?

  (cd rpm1; objdump -d $f > ../dump1)
  (cd rpm2; objdump -d $f > ../dump2)