[Bug 1207369] New: velociraptor embeds build date
http://bugzilla.opensuse.org/show_bug.cgi?id=1207369 Bug ID: 1207369 Summary: velociraptor embeds build date Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: jeffm@suse.com Reporter: bwiedemann@suse.com QA Contact: qa-bugs@suse.de Blocks: 1047218 Found By: Development Blocker: --- Building the Factory/velociraptor rpm twice results in this diff in the produced binary: filterdiff strings RPMS*/usr/bin/velociraptor --- strings RPMS.2017/usr/bin/velociraptor +++ strings RPMS/usr/bin/velociraptor @@ -655649,7 +655649,7 @@ go1.19.5 /usr/lib64/go/1.19 call frame too large -2023-01-21T05:53:04Z +2023-01-21T05:53:48Z 3456789:;<=>@ABC o~rA .`h* @@ -656015,7 +656015,7 @@ dep www.velocidex.com/golang/vfilter v0.0.0-20221124045546-c666c341aec3 dep www.velocidex.com/golang/vtypes v0.0.0-20220816192452-6a27ae078f12 build -compiler=gc -build -ldflags="-s -w -X \"www.velocidex.com/golang/velociraptor/config.build_time=2023-01-21T05:53:04Z\" -X \"www.velocidex.com/golang/velociraptor/config.commit_hash=\"" +build -ldflags="-s -w -X \"www.velocidex.com/golang/velociraptor/config.build_time=2023-01-21T05:53:48Z\" -X \"www.velocidex.com/golang/velociraptor/config.commit_hash=\"" build -tags=server_vql,extras,release,yara,linuxbpf,libbpfgo_full_static build CGO_ENABLED=1 build CGO_CFLAGS= @@ -742898,7 +742898,7 @@ dep www.velocidex.com/golang/vfilter v0.0.0-20221124045546-c666c341aec3 dep www.velocidex.com/golang/vtypes v0.0.0-20220816192452-6a27ae078f12 build -compiler=gc -build -ldflags="-s -w -X \"www.velocidex.com/golang/velociraptor/config.build_time=2023-01-21T05:53:04Z\" -X \"www.velocidex.com/golang/velociraptor/config.commit_hash=\"" +build -ldflags="-s -w -X \"www.velocidex.com/golang/velociraptor/config.build_time=2023-01-21T05:53:48Z\" -X \"www.velocidex.com/golang/velociraptor/config.commit_hash=\"" build -tags=server_vql,extras,release,yara,linuxbpf,libbpfgo_full_static build CGO_ENABLED=1 build CGO_CFLAGS= Please either drop the build date or replace it with $SOURCE_DATE_EPOCH see details in https://reproducible-builds.org/docs/source-date-epoch/ -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1207369 http://bugzilla.opensuse.org/show_bug.cgi?id=1207369#c3 --- Comment #3 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1207369) was mentioned in https://build.opensuse.org/request/show/1063430 Factory / velociraptor -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1207369 http://bugzilla.opensuse.org/show_bug.cgi?id=1207369#c4 --- Comment #4 from Bernhard Wiedemann <bwiedemann@suse.com> --- I retested security:sensor/velociraptor - still is unfixed. /usr/bin/velociraptor differs in ELF sections 29d3dc0 7777772e 76656c6f 63696465 782e636f www.velocidex.co 29d3dd0 6d2f676f 6c616e67 2f76656c 6f636972 m/golang/velocir 29d3de0 6170746f 722f636f 6e666967 2e627569 aptor/config.bui - 29d3df0 6c645f74 696d653d 32303233 2d30322d ld_time=2023-02- - 29d3e00 30375430 343a3030 3a33395a 5c22202d 07T04:00:39Z\" - + 29d3df0 6c645f74 696d653d 32303339 2d30332d ld_time=2039-03- + 29d3e00 31315431 373a3231 3a31365a 5c22202d 11T17:21:16Z\" - 29d3e10 58205c22 7777772e 76656c6f 63696465 X \"www.velocide 29d3e20 782e636f 6d2f676f 6c616e67 2f76656c x.com/golang/vel 29d3e30 6f636972 6170746f 722f636f 6e666967 ociraptor/config It seems, velociraptor-reproducible-timestamp.diff is missing from velociraptor.spec -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1207369 http://bugzilla.opensuse.org/show_bug.cgi?id=1207369#c5 Bernhard Wiedemann <bwiedemann@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #5 from Bernhard Wiedemann <bwiedemann@suse.com> --- => SR 1063543 I confirmed that using velociraptor-reproducible-timestamp.diff made builds reproducible. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1207369 http://bugzilla.opensuse.org/show_bug.cgi?id=1207369#c6 --- Comment #6 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1207369) was mentioned in https://build.opensuse.org/request/show/1064242 Factory / velociraptor -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@suse.com