<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi folks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">A few months have passed since the last discussion on "Making reproducible builds & GitBOM work together in spite of low-level component variation".<o:p></o:p></p>
<p class="MsoNormal"><a href="https://lists.reproducible-builds.org/pipermail/rb-general/2022-June/002637.html">https://lists.reproducible-builds.org/pipermail/rb-general/2022-June/002637.html</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here are some advances in gitBOM: Now gitBOM supports not-embedding gitBOM-identifier into output artifacts. This will solve the build-reproducibility issue caused by embedding gitBOM ID in artifacts. By default, the various gitBOM tools
will still embed gitBOM identifier, but user can configure the tool to not embed, and the tool will still create the gitBOM ADG (Artifact Dependency Graph) documents correctly.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In order to support not-embedding gitBOM ID, the build tool must persist the artifact-ID to ADG-doc mappings at some external location. For example, the artifact-ID to ADG-doc mappings can be persisted in the file system via symlink farm.
When a new artifact is created, its associated ADG document is computed and generated, and a symlink file is also created which points to its associated ADG document. This way, without embedding a bom-id in the output artifact, we still know the associated
bom-id for an artifact.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here are some gitBOM tools that support not embedding bom-id into artifacts:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://github.com/git-bom/bomsh">https://github.com/git-bom/bomsh</a><o:p></o:p></p>
<p class="MsoNormal"><a href="https://github.com/git-bom/gcc-gitbom">https://github.com/git-bom/gcc-gitbom</a><o:p></o:p></p>
<p class="MsoNormal"><a href="https://github.com/git-bom/binutils-gitbom">https://github.com/git-bom/binutils-gitbom</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The gitBOM behavior of the GCC and binutils tools are configured via the environment variable GITBOM_BUILD_MODE (or similar variable names).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The bomsh tool is special because it can create the gitBOM documents for already-released official Debian packages which are build-reproducible. When your Debian package hello.deb is created, a symlink hello.deb.gitbom_adg is created for
you automatically, which points to its associated ADG doc. When using the bomsh tool, please remember to modify the bomtrace.conf file to add the "-n" option, which tells bomsh to not embed bom-id to output files.<o:p></o:p></p>
<p class="MsoNormal"><a href="https://github.com/omnibor/bomsh#Generating-gitBOM-ADGs-for-Debian-or-RPM-Packages-with-Bomtrace2">https://github.com/omnibor/bomsh#Generating-gitBOM-ADGs-for-Debian-or-RPM-Packages-with-Bomtrace2</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If reproducible build becomes the main user of the bomsh tool, we can probably change the default bomsh option to not embed bom-id.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If multiple Debian builds generate the exact same gitBOM ID, it is actually a stronger reproducibility than the existing build-reproducibility because it means all the intermediate object files are also same.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Let me know if there are any questions/comments.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">BTW, gitBOM has been renamed to OmniBOR to avoid confusion with git and BOM.<o:p></o:p></p>
<p class="MsoNormal"><a href="https://omnibor.io/">https://omnibor.io/</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Yongkui<o:p></o:p></p>
</div>
</body>
</html>