[tbb-bugs] #27827 [Obfuscation/Snowflake]: Reproducibility issue of the snowflake osx64 build

[Tor Bug Tracker & Wiki]

#27827: Reproducibility issue of the snowflake osx64 build
-------------------------------------------+------------------------------
 Reporter:  boklm                          |          Owner:  tbb-team
     Type:  defect                         |         Status:  needs_review
 Priority:  Very High                      |      Milestone:
Component:  Obfuscation/Snowflake          |        Version:
 Severity:  Normal                         |     Resolution:
 Keywords:  tbb-rbm, TorBrowserTeam201810  |  Actual Points:
Parent ID:                                 |         Points:
 Reviewer:                                 |        Sponsor:
-------------------------------------------+------------------------------
Changes (by dcf):

 * status:  assigned => needs_review


Comment:

 I have a mostly working branch [https://gitweb.torproject.org/user/dcf
 /tor-browser-
 build.git/commit/?h=bug_27827&id=f92f149ea8ffb9dd64a798453c85aa124a9391aa
 bug_27827].

 It updates to go1.11.1. This update removed all the `/tmp/go-
 build000000000` paths that we previously had to overwrite. However it left
 a single `/tmp/go-link-000000000/go.o` path. This path was also affecting
 the Go build ID (a hash of the build inputs), so it couldn't be fixed just
 by overwriting. However, I found a `-tmpdir` flag that lets us replace the
 random path with a static path, and that fixed it.

 There is still a reproducibility problem, which is the gzip timestamp
 (bytes 4, 5, 6, 7) in the tar.gz output file differ across builds. I.e.,
 the complete diffoscope output is
 {{{
 --- bug_27827/tmpdir/snowflake.tar.gz.1
 +++ bug_27827/tmpdir/snowflake.tar.gz.2
 ├── metadata
 │ @@ -1 +1 @@
 │ -gzip compressed data, last modified: Wed Oct 17 16:30:51 2018, from
 Unix
 │ +gzip compressed data, last modified: Wed Oct 17 16:34:52 2018, from
 Unix
 }}}
 I'm guessing that this is some other problem unrelated to go or snowflake.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/27827#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online