| commit | 3871fa1003840be797fc3f49efb716ae5f4862b1 | [log] [tgz] |
|---|---|---|
| author | Jan Schär <jan@monogon.tech> | Wed Jul 09 17:30:00 2025 +0000 |
| committer | Jan Schär <jan@monogon.tech> | Thu Jul 10 11:11:12 2025 +0000 |
| tree | 22394cf2fbae2c134fc297b9e7231b640b3b9218 | |
| parent | 58bbc85c27d2d91276113640ba1fe6ea0f2e8b0c [diff] |
osbase/build/mkverity: make build reproducible The verity encoder previously generated a random salt. To make the build reproducible, the salt is now taken from a hash of the entire input file. I shortened the salt from 64 bytes to 16 bytes. This is enough for the purpose of the salt, which is to make hash collisions not reusable across images. A potential benefit of the 64 byte salt is that it fills a sha256 block and thus the remaining data is aligned to that block size. On the other hand, with a 16 byte salt, one fewer hash block is needed because the sha256 length fits in the last partially filled block. The encoder also generated a random UUID, but this did not affect reproducibility as we do not write the superblock. For now, I removed the UUID generation as it is completely unused. Now, the build of //metropolis/node:oci_image is reproducible on my machine. Change-Id: I756ca31d02e65c7d6ce7bbfd6749c835ab696f3f Reviewed-on: https://review.monogon.dev/c/monogon/+/4418 Reviewed-by: Lorenz Brun <lorenz@monogon.tech> Tested-by: Jenkins CI
This is the main repository containing the source code for the Monogon Platform.
This is pre-release software - take a look, and check back later! In the meantime, join us on Matrix (#monogon-os-community:matrix.org) or Discord.
Our build environment is self-contained and requires only minimal host dependencies:
/dev/kvm (if you want to run tests).Our docs assume that Bazelisk is available as bazel on your PATH.
Refer to SETUP.md for detailed instructions.
The source code lives in //metropolis (Metropolis is the codename of Monogon OS).
See the //metropolis/README.md for a developer quick start guide, or see the Monogon OS Handbook for user documentation.