tree 22394cf2fbae2c134fc297b9e7231b640b3b9218
parent 58bbc85c27d2d91276113640ba1fe6ea0f2e8b0c
author Jan Schär <jan@monogon.tech> 1752082200 +0000
committer Jan Schär <jan@monogon.tech> 1752145872 +0000

osbase/build/mkverity: make build reproducible

The verity encoder previously generated a random salt. To make the build
reproducible, the salt is now taken from a hash of the entire input
file.

I shortened the salt from 64 bytes to 16 bytes. This is enough for the
purpose of the salt, which is to make hash collisions not reusable
across images. A potential benefit of the 64 byte salt is that it fills
a sha256 block and thus the remaining data is aligned to that block
size. On the other hand, with a 16 byte salt, one fewer hash block is
needed because the sha256 length fits in the last partially filled
block.

The encoder also generated a random UUID, but this did not affect
reproducibility as we do not write the superblock. For now, I removed
the UUID generation as it is completely unused.

Now, the build of //metropolis/node:oci_image is reproducible on my
machine.

Change-Id: I756ca31d02e65c7d6ce7bbfd6749c835ab696f3f
Reviewed-on: https://review.monogon.dev/c/monogon/+/4418
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
Tested-by: Jenkins CI