bug#36747: Official MesCC bootstrap binaries differ from my locally built ones

[Mark H Weaver]

Hi Ludovic,

Ludovic Courtès <address@hidden> writes:

> Mark H Weaver <address@hidden> skribis:
>
>>> I have added a very similar set of two patches to wip-cu-binaries,
>>> branched @ ef809e3ac036eccc5f9c9edd8fb661d14ae15f2f.
>>>
>>> They give the same md5sum for me as the wip-binaries branch that
>>> branched off of master; so mine are at
>>> http://lilypond.org/janneke/guix/20190722/
>>
>> I built these, and here are the results:
>>
>> mhw@jojen /gnu/store/hd3lk0f08a0sq40qqa6yv1q9gbk7gxww-bootstrap-tarballs-0$ 
>> sha256sum *
>> b5915c71ff5ea722864e1097ce1e7ed50fd68ad7544521f2dd6969173c260276  
>> guile-static-stripped-2.2.4-i686-linux.tar.xz
>> 1acd8f83e27d2fac311a5ca78e9bf11a9a1638b82469870d5c854c4e7afaa26a  
>> linux-libre-headers-stripped-4.14.67-i686-linux.tar.xz
>> 021543d9bb6af55f39e68d69692e3cb74646ced2cad0bb9ac0047ef81e9d7330  
>> mescc-tools-static-stripped-0.5.2-0.bb062b0-i686-linux.tar.xz
>> fb32090071b39fc804fb9a7fba96f0bc5eb844a0efd268fb24c42e6bfa959de0  
>> mes-minimal-stripped-0.19-i686-linux.tar.xz
>> 9ee954dc19db5c8d4113c73a702fd8f79f26c51024220f2617d0572c0a85e69c  
>> static-binaries-0-i686-linux.tar.xz
>>
>> Do these match what you built?
>
> We verified things back then:
>
>   https://lists.gnu.org/archive/html/guix-devel/2018-12/msg00046.html
>
> This was on commit 4ae7dc7b9af64794081b1913740b97acd89c91bc, which is
> earlier than the one you’re looking at (commit
> ef809e3ac036eccc5f9c9edd8fb661d14ae15f2f, right?)

Yes.  However, I just noticed a more serious problem.

The "independent verification" that you and I performed at commit
4ae7dc7b9af64794081b1913740b97acd89c91bc was bogus, because at that
commit, %bootstrap-inputs had already been changed to use an earlier
draft of the reduced binary seed, based on unverified bootstrap tarballs
downloaded from lilypond.org.

In order to perform a truly independent verification, we need to build
the new bootstrap binaries without using the new bootstrap binaries.
Otherwise our verification is circular.

It seems to me that the best way to accomplish this is to backport the
new '%bootstrap-tarballs' from 'wip-cu-binaries' to the 'master' branch.

What do you think?

      Thanks,
        Mark