1217690 – libcamera: reproducible builds vs signatures

Bug 1217690 - libcamera: reproducible builds vs signatures

Summary: libcamera: reproducible builds vs signatures

Status:	NEW

Alias:	None

Product:	openSUSE Tumbleweed
Classification:	openSUSE
Component:	Other (show other bugs)
Version:	Current
Hardware:	Other All

Priority:	P5 - None Severity: Normal (vote)
Target Milestone:	---
Assignee:	Robert Frohl
QA Contact:	E-mail List

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:	1062303
	Show dependency tree / graph

Clone This Bug

Reported:	2023-11-30 10:32 UTC by Bernhard Wiedemann
Modified:	2023-11-30 12:02 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Development
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Bernhard Wiedemann 2023-11-30 10:32:28 UTC

While working on reproducible builds for openSUSE+ALP, I found that
our libcamera package varies in every build
because during build it creates a random keypair,
embeds the pubkey
adds .so.sign files

When I asked upstream about it long ago, it was said to prevent smuggling in of 3rd party modules that shall not receive the same level of permissions
as modules that are shipped as part of the main codebase.

Can we patch src/libcamera/ipa_module.cpp to not use .sign files
or is there another way to get reproducible build results for libcamera?

Comment 1 Robert Frohl 2023-11-30 10:55:11 UTC

I just did the last version bump, not sure if I am the right assignee. 

@Jan: Should I assign the bug to you as the maintainer or do you have no time to work on this ?

Comment 2 Jan Engelhardt 2023-11-30 12:02:24 UTC

I was thinking one could perhaps replace the generated key with the openSUSE build key, but #needssslcertforbuild only adds the pubkey to the build root, which is not enough to sign the libcamera modules.

I do not plan on putting any more effort in this. Whether we disable signing or whether just leave it producing random builds, I have no preference for either.