[rtcweb] Hermetic builds (Re: Cisco to open source its H.264 implementation and absorb MPEG-LA licensing fees)

[Harald Alvestrand <[e-mail]>]

Since this is a subthread with technical content, I'd like it to have 
its own header....

the name I've heard for this kind of generation environments is 
"hermetic build".
Google's been trying for hermetic builds for NaCL for instance - see 
this doc:
http://www.chromium.org/nativeclient/design-documents/building-a-hermetic-toolchain-on-cygwin


On 12/13/2013 04:33 AM, Mo Zanaty (mzanaty) wrote:
> Yes, Cisco and Mozilla plan on solving fully reproducible binaries for all
> targets officially supported in the openh264 project. Nothing less would
> be acceptable to the community, especially given the recent security
> incidents.
>
> We welcome contributions from anyone who has struggled with this in the
> past, and is aware of specific problems or solutions beyond the obvious
> ones below.
>
> 1. Identical source trees (git hash)
> 2. Identical project configuration (make targets that include all
> configuration options)
> 3. Identical tool chains on similar build machines (same arch at least,
> probably x86-64)
> 4. Deterministic tool chains (avoid tool options that lack determinism)
> 5. Deterministically identical tool chain output must be hashed separately
> from uniquely generated data (build info, etc.)
>
> Some feel that tool chains can also be subverted and therefore should also
> be built from source, using some root golden tool chain. We are not that
> paranoid yet. Should we be?

There's more fun, including:

- Sources that timestamp the compilation output (wrecks hashes)
- Sources that #include stuff from system locations (break hermeticness)

In order to get the same version of the toolchain, one pretty much has to
either distribute it with the sources or build it from source - the latter
has the same issues one level down, so distributing the toolchain may
be the simpler option.

The bootable image of the build environment may be the simplest way....


>
> Mo
>
>   
> On 12/12/13, 4:32 PM, Ron <[e-mail]> wrote:
> ...
> There is considerable work presently being done on fully reproducible
> binaries, since obviously this is of interest on many fronts, but it's
> currently far from being a universally (or easily) Solved Problem.
>
> Is Cisco actually planning to invest work into solving this (for all
> architectures!) as part of this project?
> ...
>
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb