Optional (?) support for reproducible builds of LK.

[shymega-ct]

Hi,

It would be beneficial, if we could allow for reproducible builds of Littlekernel.

Currently, although there are a lot of forks of lk, so it's hard to be certain, the date/time of a build is embedded in the lk ELF/bin. I have not yet isolated the cause of this, but I can see ./lib/version/buildid.sh in this upstream repo's sources, which may also present a reproducibility issue.

Reproducibility means vendors can ensure that the resulting binary is built from X sources, known as provenance.

Is this possible in lk? Can someone provide some pointers on where date/timestamps are embedded into the resulting ELF/.bin?

Thanks!

[travisg]

Yep, all the build system needs to do is define BUILDID somewhere and it'll be used in lib/version versus the one generated by buildid.sh. That's basically a fallback id that puts a timestamp in it, using some sort of Android style timestamp.

As far as determining the version of an existing binary there's a version struct embedded in it (if it included lib/version) but it's a bit hard to find by searching through the binary unless lib/buildsig is also included, which puts a structure in the binary that can be searched for. Look in lib/buildsig to see the structure of it, it's intended to be searchable via an external script or program to find (though i dont see a copy of that script in the tree).

[shymega-ct]

Hi Travis, Thanks for replying - and your throrough explanation. Perhaps we could document the BUILDID variable somewhere for future reference? Of course, there are a lot of downstream derivatives of `lk`, so it's hard to be sure of all builds and reproducibility, but to have it upstream is a good move. Did you find the script you mentioned?