Re: [edk2-devel] Current State of Build Reproducibility in edk2

["Richard Lyu via groups.io" <richard.lyu=suse.com@groups.io>]

Hi Oliver,

I also noticed that edk2 is currently not reproducible in OvmfPkg because the stack cookie value has been randomized in AutoGen.h since edk2-stable202502. Fortunately, commit "cac0955658 BaseTools: Update Stack Cookie Logic" addresses this issue. By keeping the JSON files in the build directory, the STACK_COOKIE_VALUE can be made reproducible.

I’ve tested this and was able to reproduce the same FDs and FVs with both edk2-stable202502 and edk2-stable202505. Perhaps you might like to give it a try as well.

Best regards,
Richard Lyu



On 2025/06/19 09:53, Oliver Smith-Denny via groups.io wrote:
> On 6/18/2025 5:21 PM, Michael D Kinney via groups.io wrote:
> > Should work for physical platform builds.
> > 
> > The OVMF and EmulatorPkg build may have some timestamps in them.
> > 
> > If the EmbeddedPkg VirtualRealTimeClockLib is used, then it pulls in system time
> > in Linux builds.  I have a proposal to address this one queued up to support
> > both windows and linux and reproducible builds when needed.
> > 
> > [BuildOptions]
> >    GCC:*_*_*_CC_FLAGS = -DBUILD_EPOCH=`printenv SOURCE_DATE_EPOCH || date +%s`
> > 
> > The following is a good resource on this topic and all the
> > elements need to be tracked so issues do not get introduced.
> > 
> > 	https://reproducible-builds.org/docs/
> > 
> 
> Thanks, let me play around with this some more. It may be that the
> platform I started trying this with had some similar dependencies.
> 
> Thanks,
> Oliver
> 
> 
> 
> 
> 
> 


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#121428): https://edk2.groups.io/g/devel/message/121428
Mute This Topic: https://groups.io/mt/113714425/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-