Comment # 1 on bug 1217967 from Joey Lee

(In reply to Bernhard Wiedemann from comment #0)
> While working on reproducible builds for ALP + openSUSE, I found that our
> grub2 package produced different results when built locally
> compared to the official Factory build on OBS.
> 
> My guess is that it comes from
> https://github.com/openSUSE/pesign-obs-integration
> 
> filterdiff 'rpm -qp --qf %{PLATFORM}\n'
> binaries*/grub2-2.12~rc1-12.1.x86_64.rpm
> --- rpm -qp --qf %{PLATFORM}\n binaries/grub2-2.12~rc1-12.1.x86_64.rpm
> +++ rpm -qp --qf %{PLATFORM}\n
> binaries.nachbau/grub2-2.12~rc1-12.1.x86_64.rpm
> @@ -1 +1 @@
> -x86_64-suse-linux
> +i386-suse-linux-gnu
> 
> using
> https://github.com/bmwiedemann/reproducibleopensuse/blob/master/filterdiff
> 
> 
> Apart from that, there is the (probably unavoidable) sig itself:
> --- old /usr/share/grub2/x86_64-efi/grub.efi (hex)
> +++ new /usr/share/grub2/x86_64-efi/grub.efi (hex)
> @@ -1,6 +1,6 @@
>  00000100  00 00 00 00 10 00 00 00  00 00 00 00 00 00 00 00 
> |................|
>  00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
> |................|
> -00000120  00 00 00 00 00 00 00 00  00 50 1f 00 70 07 00 00 
> |.........P..p...|
> +*
>  00000130  00 30 1f 00 00 20 00 00  00 00 00 00 00 00 00 00  |.0...
> ..........|
>  00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
> |................|
>  *

In factory, grub2 be signed by openSUSE key. I am not sure which key be used
for signing in your local environment. 
Could you please use pesign to check the signatures list of grub2.efi? Just
compare two different grub2.efi.

pesign -S -i ./grub2.efi