[coreboot] coreboot reproducible builds almost there

[Holger Levsen]

Dear coreboot folks,

adding the Debian reproducible-builds lists to cc: - please either cc: that 
list or me on replies, i'm not subscribed to the coreboot list.

On Donnerstag, 11. Juni 2015, Paul Menzel wrote:
> Holger Levsen joined #coreboot at irc.freenode.net yesterday to report that
> he integrated coreboot into the reproducible builds infrastructure [1].

indeed :) Thanks for sharing this here!

I'm now wondering how to proceed further. I *believe* another set of tests, 
this time with payloads, would be useful, if only to prove that the 
combination "reproducible coreboot" plus "reproducible payload" also is 
reproducible.

Things is, _AIUI_, there is no common payload which can be enabled for all 
boards. Is that correct?

If it is, is there another way to sensible group targets by payloads or detect 
sensible ones? Currently I'm building all targets in one pass using abuild, 
but I could also loop through each target and build it individually, as long 
as I dont have to configure 247 different configurations... (rather easy would 
be, all i386 targets use seabios, all mips target $that_one and all arm 
targets $another_one...


And then I'm wondering, "what next"? AIUI you don't ever offer images for 
download and instead expect users to build coreboot themselves. So the whole 
topic of verifying and reproducing the vendors (=your!) binaries is a bit mood 
here, at least atm. Any comments on that?

Last, and probably least: currently the headline of the page says "fast, 
flexible and reproducible Open Source firmware_?_" which I felt was 
appropriate when only a few images with payload were reproducible. Now I've 
been thinking about removing the questionmark, but in a way I like to keep it, 
til you reached 100% (without payloads) - do you think thats "ok"? IOW: do you 
feel offended (or maybe just a bit "hmm") by the questionmark or do you see it 
as motivation (to reach 100%)? ;-)

Oh, and as the page says, it's currently only updated once a month and on 
demand, so please do ping me if you merged some reproducible changes into 
master!


Thanks for your work on coreboot - it's really awesome & amazing! Free the 
hardware! :-)


cheers,
	Holger, happy about any feedback basically. coreboot.html is *your* 
		page, not mine! :-)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 828 bytes
Desc: This is a digitally signed message part.
URL: <http://www.coreboot.org/pipermail/coreboot/attachments/20150611/56ce440c/attachment.asc>