[tor-bugs] #31538 [Applications/Tor Browser]: Windows bundles based on ESR 68 are not built reproducibly

[Tor Bug Tracker & Wiki]

#31538: Windows bundles based on ESR 68 are not built reproducibly
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:  new
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tbb-rbm, ff68-esr, tbb-9.0-must-     |  Actual Points:
  alpha, TorBrowserTeam201909,                   |
  GeorgKoppen201909                              |
Parent ID:  #30322                               |         Points:  2
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by gk):

 Replying to [comment:19 gk]:
 > However, other object files are still included non-deterministically
 after that part. I am not sure yet where they are coming from...

 Okay, I think I am at the bottom of that rabbit hole. Thre reason for that
 issue is that `libc++.a` is getting merged with the contents of
 `libc++abi.a` (which, by the way, itself is reproducible at least after
 switching to CMake's 3.5.13). Now, that merging gets done in libc++'s
 `merge_archives.py` (https://github.com/llvm/llvm-
 project/blob/release/8.x/libcxx/utils/merge_archives.py). The problem here
 is:
 {{{
 files = glob.glob(os.path.join(temp_directory_root, '*.o*'))
 }}}
 From the doc (https://docs.python.org/2/library/glob.html):
 {{{
 "The glob module finds all the pathnames matching a specified pattern
 according to the rules used by the Unix shell, although results are
 returned in arbitrary order."
 }}}
 So, doing a simple
 {{{
 files = sorted(glob.glob(os.path.join(temp_directory_root, '*.o*')))
 }}}
 gets us finally a reproducible `libc++.a` and a reproducible 64-bit .exe.
 I am currently testing the 32-bit version as well and will prepare a
 proper patch for review tomorrow.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31538#comment:20>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online