Skip to content

Commit 20f65f9

Browse files
gendxgendx
committed
Add GitHub workflow to check that binaries are reproducible.
1 parent a2eff7c commit 20f65f9

File tree

8 files changed

+141
-8
lines changed

8 files changed

+141
-8
lines changed

‎.github/workflows/reproducible.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
name: Check that binaries are reproducible
3+
on:
4+
push:
5+
pull_request:
6+
types: [opened, synchronize, reopened]
7+
8+
jobs:
9+
check_hashes:
10+
strategy:
11+
matrix:
12+
os: [ubuntu-18.04, macos-10.15]
13+
runs-on: ${{ matrix.os }}
14+
steps:
15+
- uses: actions/checkout@v2
16+
- uses: actions-rs/toolchain@v1
17+
with:
18+
target: thumbv7em-none-eabi
19+
- uses: actions/setup-python@v1
20+
with:
21+
python-version: 3.7
22+
- name: Install Python dependencies
23+
run: python -m pip install --upgrade pip setuptools wheel
24+
- name: Set up OpenSK
25+
run: ./setup.sh
26+
27+
- name: Use sample cryptographic material
28+
run: rm -R crypto_data/ && cp -r reproducible/sample_crypto_data crypto_data
29+
- name: Computing cryptographic hashes
30+
run: ./reproduce_hashes.sh
31+
32+
- name: Upload reproduced binaries
33+
uses: actions/upload-artifact@v1
34+
with:
35+
name: reproduced-${{ matrix.os }}
36+
path: reproducible/reproduced.tar
37+
38+
- name: Comparing cryptographic hashes
39+
run: git diff --no-index reproducible/reference_binaries_${{ matrix.os }}.sha256sum reproducible/binaries.sha256sum

‎deploy.py

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -392,19 +392,17 @@ def create_tab_file(self, binaries):
392392
assert self.args.application
393393
info("Generating Tock TAB file for application/example {}".format(
394394
self.args.application))
395-
package_parameter = "-n"
396395
elf2tab_ver = self.checked_command_output(["elf2tab", "--version"]).split(
397-
" ", maxsplit=1)[1]
398-
# Starting from v0.5.0-dev the parameter changed.
399-
# Current pyblished crate is 0.4.0 but we don't want developers
400-
# running the HEAD from github to be stuck
401-
if "0.5.0-dev" in elf2tab_ver:
402-
package_parameter = "--package-name"
396+
"\n", maxsplit=1)[0]
397+
if elf2tab_ver != "elf2tab 0.5.0":
398+
fatal("Unsupported elf2tab version {!a}. Please use 0.5.0.".format(
399+
elf2tab_ver))
403400
os.makedirs(self.tab_folder, exist_ok=True)
404401
tab_filename = os.path.join(self.tab_folder,
405402
"{}.tab".format(self.args.application))
406403
elf2tab_args = [
407-
"elf2tab", package_parameter, self.args.application, "-o", tab_filename
404+
"elf2tab", "--deterministic", "--package-name", self.args.application,
405+
"-o", tab_filename
408406
]
409407
if self.args.verbose_build:
410408
elf2tab_args.append("--verbose")

‎reproduce_board.sh

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
# Copyright 2019 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
set -ex
17+
18+
echo "Board: $BOARD"
19+
./deploy.py --verbose-build --board=$BOARD --no-app --programmer=none
20+
./third_party/tock/tools/sha256sum/target/debug/sha256sum third_party/tock/target/thumbv7em-none-eabi/release/$BOARD.bin >> reproducible/binaries.sha256sum
21+
tar -rvf reproducible/reproduced.tar third_party/tock/target/thumbv7em-none-eabi/release/$BOARD.bin
22+
23+
./deploy.py --verbose-build --board=$BOARD --opensk --programmer=none
24+
./third_party/tock/tools/sha256sum/target/debug/sha256sum target/${BOARD}_merged.hex >> reproducible/binaries.sha256sum
25+
tar -rvf reproducible/reproduced.tar target/${BOARD}_merged.hex

‎reproduce_hashes.sh

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/usr/bin/env bash
2+
# Copyright 2019 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
set -ex
17+
18+
rm -f reproducible/binaries.sha256sum
19+
20+
echo "Creating reproducible/reproduced.tar"
21+
touch empty_file
22+
tar -cvf reproducible/reproduced.tar empty_file
23+
rm empty_file
24+
25+
echo "Building sha256sum tool..."
26+
cargo build --manifest-path third_party/tock/tools/sha256sum/Cargo.toml
27+
28+
echo "Computing SHA-256 sums of the boards..."
29+
for board in nrf52840dk nrf52840_dongle nrf52840_dongle_dfu nrf52840_mdk_dfu
30+
do
31+
BOARD=$board ./reproduce_board.sh
32+
done
33+
34+
echo "Computing SHA-256 sum of the TAB file..."
35+
./third_party/tock/tools/sha256sum/target/debug/sha256sum target/tab/ctap2.tab >> reproducible/binaries.sha256sum
36+
tar -rvf reproducible/reproduced.tar target/tab/ctap2.tab

‎reproducible/reference_binaries_macos-10.15.sha256sum

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
b113945b033eb229e3821542f5889769e5fd2e2ae3cb85c6d13a4e05a44a9866 third_party/tock/target/thumbv7em-none-eabi/release/nrf52840dk.bin
2+
b16a815411e4dfdd8ceb8588b47861e33f9282b0ffa10660692783b4e2cd6179 target/nrf52840dk_merged.hex
3+
346016903ddf244a239162b7c703aafe7ec70a115175e2204892e874f930f6be third_party/tock/target/thumbv7em-none-eabi/release/nrf52840_dongle.bin
4+
5ba6bdd42d1036df6347119020925404029999bcba51409a56327070bca1ff62 target/nrf52840_dongle_merged.hex
5+
adcc4caaea86f7b0d54111d3080802e7389a4e69a8f17945d026ee732ea8daa4 third_party/tock/target/thumbv7em-none-eabi/release/nrf52840_dongle_dfu.bin
6+
bf6aeafe25197ca500e7c39abf713b85d748722a6a65edefe8a9093d4d1f8100 target/nrf52840_dongle_dfu_merged.hex
7+
97a7dbdb7c3caa345307d5ff7f7607dad5c2cdc523b43c68d3b741ddce318e92 third_party/tock/target/thumbv7em-none-eabi/release/nrf52840_mdk_dfu.bin
8+
45631c7fb72d56446a966a3b58a6ff5513f94a6052641938cd49e9a9498b959f target/nrf52840_mdk_dfu_merged.hex
9+
5ae401ae89f6155820527d5099948f337f8e3fc93da18ccdd150c645b6a53ea9 target/tab/ctap2.tab

‎reproducible/reference_binaries_ubuntu-18.04.sha256sum

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
921d6fc31f7235456dd41abc7e634a37ee87b5016b80c979d20ac5d3fcfc6b6b third_party/tock/target/thumbv7em-none-eabi/release/nrf52840dk.bin
2+
450c3775cc16e812519b9a65aaaa21c9cd8cc89881735f2c2c5f540793f54fe1 target/nrf52840dk_merged.hex
3+
aab5bdc406b1e874b83872c9358d310070b3ce948ec0e20c054fb923ec879249 third_party/tock/target/thumbv7em-none-eabi/release/nrf52840_dongle.bin
4+
bdc557bedaedb39e74d234a243a86fbf15623498a47a8941ec588cfc83fb4f56 target/nrf52840_dongle_merged.hex
5+
26b8513e76058e86a01a4b408411ce429834eb2843993eb1671f2487b160bc9a third_party/tock/target/thumbv7em-none-eabi/release/nrf52840_dongle_dfu.bin
6+
4d5dee48187600023bbac889d61ca0f626891590cafff45f73dcbcf4ef9875e5 target/nrf52840_dongle_dfu_merged.hex
7+
7cc558a66505e8cf8170aab50e6ddcb28f349fd7ced35ce841ccec33a533bea1 third_party/tock/target/thumbv7em-none-eabi/release/nrf52840_mdk_dfu.bin
8+
34adf76fec8502d86a298607bf74d559710e4e8c644dc19d2e41e2f830cf9203 target/nrf52840_mdk_dfu_merged.hex
9+
89b80eccf75175f9a8c9be2c3adccbe7d2ee9b7cbca896bf0605c3a6b8a09cf6 target/tab/ctap2.tab

‎reproducible/sample_crypto_data/opensk.key

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
-----BEGIN EC PARAMETERS-----
2+
BggqhkjOPQMBBw==
3+
-----END EC PARAMETERS-----
4+
-----BEGIN EC PRIVATE KEY-----
5+
MHcCAQEEICMfnFy7L3y5p2MOGezavAeS+noKYtT21mDcWllN7Y1zoAoGCCqGSM49
6+
AwEHoUQDQgAEhZflF2Fq4xmAofKOxG/0sx8bucdpJPRLR4HXArAFXJzdLF9ofkpn
7+
gzsVWzTYFr+nNiyxySyJsdkH/qQv4rCV0A==
8+
-----END EC PRIVATE KEY-----

‎reproducible/sample_crypto_data/opensk_cert.pem

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBPDCB4wIUTEbgPPL3tr2rLkI83EyzyQJQmYEwCgYIKoZIzj0EAwIwGzEZMBcG
3+
A1UEAwwQR29vZ2xlIE9wZW5TSyBDQTAeFw0yMDA0MTQxNTM5MDRaFw0zMDA0MTQx
4+
NTM5MDRaMCcxJTAjBgNVBAMMHEdvb2dsZSBPcGVuU0sgSGFja2VyIEVkaXRpb24w
5+
WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASFl+UXYWrjGYCh8o7Eb/SzHxu5x2kk
6+
9EtHgdcCsAVcnN0sX2h+SmeDOxVbNNgWv6c2LLHJLImx2Qf+pC/isJXQMAoGCCqG
7+
SM49BAMCA0gAMEUCIBKkHijpTbjlPDv3oFw/nW/ta8jEMhY8iNCBp9N0+NNYAiEA
8+
ywzrGpmc0reEUFCGHBBdvC2E2SxIlvaefz7umT8ajy4=
9+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)