Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 25 Sep 2013 09:59:59 -0400
From: Steve Grubb <>
Cc: Sebastian Krahmer <>
Subject: Re: Reproducible Builds for Fedora


On Wednesday, September 25, 2013 10:08:01 AM Sebastian Krahmer wrote:
> I was checking the rpm-compare how it actually is doing the compre
> and you have:
> [...]
>                 base=`basename $f`
>                 objdump -d rpm1/$f | grep -v $base > dump1
>                 objdump -d rpm2/$f | grep -v $base > dump2
>                 diff -u dump1 dump2 > /dev/null
>                 if [ $? -ne 0 ] ; then
>                           echo "File disassembly differs $f"
>                           cnt=`expr $cnt + 1`
>                 fi
> [...]
> for ELF files and doing a sha256sum for other file types. My concern is
> that attackers could construct a package that contains function-names that
> match the basename of the binary that you are checking.

Thanks for the feedback. I think the 'grep -v' can be replaced with sed 
'1,2d'. Its purpose was to delete the file path that objdump inserts at the top 
which causes miscompares.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.