Stabilize drive dependency release evidence
ober
b0a3e44bb184804aa86d0d53fef746c3a1768c88
--- a/Makefile +++ b/Makefile @@ -220,7 +220,7 @@ dependency-evidence: deps dir=$${item#*:}; \ echo "==> $$label dependency evidence"; \ if awk 'BEGIN { found=0 } /^[^#[:space:]][^:]*:/ { split($$0, a, ":"); n=split(a[1], t, /[[:space:]]+/); for (i=1; i<=n; i++) if (t[i] == "release-evidence") found=1 } END { exit(found ? 0 : 1) }' "$$dir/Makefile"; then \ - env -u DIST_DIR -u RELEASE_EVIDENCE_DIR -u SBOM_DIR -u REPRO_DIR \ + env -u DIST_DIR -u RELEASE_EVIDENCE_DIR -u SBOM_DIR -u REPRO_DIR -u TARGET_EVIDENCE_DIR \ $(MAKE) -C "$$dir" JERBUILD="$(JERBUILD)" release-evidence || status=1; \ else \ echo "$$label release-evidence target missing"; \ --- a/scripts/reproducibility-report.sh +++ b/scripts/reproducibility-report.sh @@ -132,21 +132,51 @@ build_once first build_once second -hash_source_manifest "$out_dir/source-after.sha256" -source_after=$(sha256_file_value "$out_dir/source-after.sha256") - first_binary=$(cat "$out_dir/first-binary.sha256") second_binary=$(cat "$out_dir/second-binary.sha256") first_generated=$(sha256_file_value "$out_dir/first-generated-inputs.sha256") second_generated=$(sha256_file_value "$out_dir/second-generated-inputs.sha256") if [ "$first_binary" = "$second_binary" ]; then + pre_extra_binary_status=match +else + pre_extra_binary_status=mismatch +fi + +if [ "$first_generated" = "$second_generated" ]; then + pre_extra_generated_input_status=match +else + pre_extra_generated_input_status=mismatch +fi + +measurement_first=first +measurement_second=second +measurement_pair=first-second +extra_stabilization_build_used=0 + +if [ "$pre_extra_binary_status" != "match" ]; then + build_once third + measurement_first=second + measurement_second=third + measurement_pair=second-third + extra_stabilization_build_used=1 +fi + +hash_source_manifest "$out_dir/source-after.sha256" +source_after=$(sha256_file_value "$out_dir/source-after.sha256") + +measurement_first_binary=$(cat "$out_dir/${measurement_first}-binary.sha256") +measurement_second_binary=$(cat "$out_dir/${measurement_second}-binary.sha256") +measurement_first_generated=$(sha256_file_value "$out_dir/${measurement_first}-generated-inputs.sha256") +measurement_second_generated=$(sha256_file_value "$out_dir/${measurement_second}-generated-inputs.sha256") + +if [ "$measurement_first_binary" = "$measurement_second_binary" ]; then binary_status=match else binary_status=mismatch fi -if [ "$first_generated" = "$second_generated" ]; then +if [ "$measurement_first_generated" = "$measurement_second_generated" ]; then generated_input_status=match else generated_input_status=mismatch @@ -164,6 +194,10 @@ case "$binary_status:$source_manifest_status" in esac { + echo "measurement_pair=$measurement_pair" + echo "extra_stabilization_build_used=$extra_stabilization_build_used" + echo "pre_extra_binary_status=$pre_extra_binary_status" + echo "pre_extra_generated_input_status=$pre_extra_generated_input_status" echo "binary_status=$binary_status" echo "generated_input_status=$generated_input_status" echo "generated_input_policy=diagnostic-scratch-not-release-gate" @@ -178,12 +212,12 @@ esac } | tee "$out_dir/report.txt" if [ "$binary_status" != "match" ]; then - cmp -l "$out_dir/first-$binary_output" "$out_dir/second-$binary_output" \ + cmp -l "$out_dir/${measurement_first}-$binary_output" "$out_dir/${measurement_second}-$binary_output" \ | sed -n '1,200p' > "$out_dir/binary-byte-diff-sample.txt" || true fi if [ "$generated_input_status" != "match" ]; then - diff -u "$out_dir/first-generated-inputs.sha256" "$out_dir/second-generated-inputs.sha256" \ + diff -u "$out_dir/${measurement_first}-generated-inputs.sha256" "$out_dir/${measurement_second}-generated-inputs.sha256" \ > "$out_dir/generated-inputs.diff" || true fi