[Mono-dev] making mono builds reproducible (xamarin bz #26842)

[Jeroen Frijters]

Hello all,

I'm not a big fan of using an environment variable for this, but I won't oppose it. In the mean time, I've added a new public API (ModuleBuilder.__PEHeaderTimeDateStamp) to specify the time stamp. There is already a public API to specify the module version GUID.

As Miguel said, hard coding the GUID violates the spec and can lead to weird problems. I think the proper solution is to base the GUID on a SHA1 of the contents of the assembly. However, this is non-trivial, so it will take some time to develop a complete solution. This will be an opt-in feature, so it will also need to be supported by mcs or an environment variable.

Marek, what do you think about adding an mcs switch to facilitate reproducible builds?

Regards,
Jeroen

> -----Original Message-----
> From: Daniel Kahn Gillmor [mailto:dkg at fifthhorseman.net]
> Sent: Monday, February 16, 2015 23:20
> To: mono development list
> Cc: Jeroen Frijters; Jo Shields; Debian Reproducible Builds; Henrik
> Feldt
> Subject: making mono builds reproducible (xamarin bz #26842)
> 
> Hi Mono folks--
> 
> some good discussion has come up on the xamarin bugtracker about being
> able to make builds using the mono toolchain reproducible:
> 
>    https://bugzilla.xamarin.com/show_bug.cgi?id=26842
> 
> Jo Shields offered a one-liner fix to PEWriter.cs to allow the use of an
> environment variable to fix the timestamp epoch, but made it clear that
> more feedback is needed, so i'm raising it here:
> 
> from:
> 
>    public DWORD TimeDateStamp = (uint)(DateTime.UtcNow - new
> DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc)).TotalSeconds;
> 
> to:
> 
>    public DWORD TimeDateStamp =
> Environment.GetEnvironmentVariable("IKVM_WRITER_TIMESTAMP_EPOCH") !=
> null ?
> 
> uint.Parse(Environment.GetEnvironmentVariable("IKVM_WRITER_TIMESTAMP_EPO
> CH")) :
>                                 (uint)(DateTime.UtcNow - new
> DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc)).TotalSeconds;
> 
> (i'm not sure whether the integer number of seconds is the best form for
> the environment variable, or whether it would be better to parse a
> standard date string -- from debian's perspective, we can deal with
> either, of course)
> 
> And this still doesn't solve the secondary issue of the assembly GUID,
> as Jo noted.
> 
> Any thoughts about how to best enable binary-reproducible builds from
> the mono toolchain if the invoker requests them?
> 
> Regards,
> 
>         --dkg