[tbb-bugs] #20184 [Applications/Tor Browser]: OS X builds are still not reproducible on some machines (was: OS X alpha builds are still not reproducible on some machines (as of 6.5a3))

[Tor Bug Tracker & Wiki]

#20184: OS X builds are still not reproducible on some machines
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:  new
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tbb-gitian, GeorgKoppen201609        |  Actual Points:
  TorBrowserTeam201609                           |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by gk):

 * cc: boklm (added)
 * priority:  Medium => Very High
 * severity:  Normal => Major


Comment:

 Okay, here is the summary of what I have so far:

 1) This happens on my machine for stable builds as well, sometimes. So
 far, it seems I have been "lucky" in that I got always matching builds.

 2) This is probably not faketime/timestamp related.

 After quite some amount of testing and reverting
 da14737254245cfa6b849dc8ac94a52cb3d9a61d it turns out that there are still
 differences between executables. Sometimes `tor` being among them and
 sometimes not.

 Another interesting fact us that I don't get different hash values for the
 `tor` executable every time. In all of my tests there were only three
 possible values.

 Attached is a typical diff (in this case between two `test-ntor-cl`
 binaries).

 Exciting!

 My current guess is this is related to the old toolchain we use for
 `gitian-utils.yml` and `gitian-tor.yml` for OS X. Not sure why this was
 not visible earlier, though. Maybe switching to Debian made this more
 likely to happen?

 My current plan is to use our clang cross-compiler for `tor` and see
 whether that fixes those diffs. While I expect that to be much harder for
 the utils we need (see: #10369) we might get away with doing that just for
 `tor` for now.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20184#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online