I have no idea about signing, but I know someone who does :)

The timestamp marked when the EFI image was signed, and the "noise" is a part of the signature.

If you want to strip the signature, use the following command:

$ pesign -r -u 0 -i <input> -o <output>

then you can compare the real binary contents.

Do we want to strip the signature? I think its important to republish if the signature happens to differ. 

Hopefully there is a way to provide stable input to get stable output.

(In reply to Olaf Hering from comment #4)
> Do we want to strip the signature? I think its important to republish if the
> signature happens to differ. 
> 
The problem is if you want the signature to be the same, you have to "fake" the signing time.

> Hopefully there is a way to provide stable input to get stable output.
The other way I know is to compare the hash of the binaries. The hash can be generated with "pesign -h -i <input>". This will be easier than comparing the binaries.

the kernel binary packages (and soon xen) already use a fixed timestamp for building. So I'm sure pesign (or whatever tool is used) can do the very same. Would that lead to identical binaries if the timestamp is always the same?

(In reply to Olaf Hering from comment #6)
> the kernel binary packages (and soon xen) already use a fixed timestamp for
> building. So I'm sure pesign (or whatever tool is used) can do the very
> same. Would that lead to identical binaries if the timestamp is always the
> same?
I think so.

Then this might be the place to fix it. There needs to be a way to pass a timestamp from the main pkg.spec to pesign-repackage.spec.

I was thinking about adding a new option to pesign to specify the timestamp so we don't have to fiddle with the binary.

Copying from email:

IMO this is more complicated than it needs to be. The rpm signatures are
not checked by the build-compare script, so there is little point in
checking the EFI singnatures byte-by-byte. The build-compare script
should be taught to only check the binary itself plus maybe the ID of
the key used to sign it.

(In reply to Michal Marek from comment #10)
> Copying from email:
> 
> IMO this is more complicated than it needs to be. The rpm signatures are
> not checked by the build-compare script, so there is little point in
> checking the EFI singnatures byte-by-byte. The build-compare script
> should be taught to only check the binary itself plus maybe the ID of
> the key used to sign it.

What exactly should it do to compare old/foo.ko new/foo.ko?

(In reply to Olaf Hering from comment #11)
> (In reply to Michal Marek from comment #10)
> > Copying from email:
> > 
> > IMO this is more complicated than it needs to be. The rpm signatures are
> > not checked by the build-compare script, so there is little point in
> > checking the EFI singnatures byte-by-byte. The build-compare script
> > should be taught to only check the binary itself plus maybe the ID of
> > the key used to sign it.
> 
> What exactly should it do to compare old/foo.ko new/foo.ko?

I am not aware of any tool to strip the signature of the kernel modules, but the structure of the signature is not complicated, so you could do it with a script.

The structure of a signed ko file is like this:

[module content][signer name][key identifier][signature][info][magic number]

Since you are going to compare the old and new ko files, [module content] is definitely the thing you want to keep. It's also good to keep [signer name] and [key identifier]. Those two come from the signer key and shouldn't change if the modules are signed by the same key. [magic number] is always "~Module signature appended~\n". Now the problem becomes how to remove [signature].

Before removing [signature], you have to parse [info]. [info] is packed by the sign-file perl script with "CCCCCxxxN". Just ignore the first 8 bytes. The last 4 bytes of [info] is the size of [signature] in the big endian order. The size is 258 under our current configuration.

In short, all you have to do is to remove the last 258+12+28 bytes. Of course, it's safer to check the size instead of using 258 directly.

For reference, the sign-file script:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/scripts/sign-file

*** Bug 906160 has been marked as a duplicate of this bug. ***

Please do not assume that the signature has a givent lenght. Parsing the information is rather simple, have a look e.g. at the kernel-sign-file script in pesign-obs-integration:

my $unsigned_module = read_file($module);

my $magic_number = "~Module signature appended~\n";
my $magic_len = length($magic_number);
my $info_len = 12;

# Truncate existing signarure, if any
if (substr($unsigned_module, -$magic_len) eq $magic_number) {
	my $info = substr($unsigned_module, -$magic_len - $info_len, $info_len);
	my ($name_len, $key_len, $sig_len) = unpack("xxxCCxxxN", $info);
	my $subtract = $name_len + $key_len + $sig_len + $info_len + $magic_len;
	if ($subtract > length($unsigned_module)) {
		die "$module: Existing signature is malformed\n";
	}
	$unsigned_module = substr($unsigned_module, 0,
		length($unsigned_module) - $subtract);
}

To keep the name and key id, only truncate $sig_len + $info_len + $magic_len bytes.