简体繁体 English

在相同的 docker 中运行构建（gcc、make、cmake），来自相同的源会给出具有不同哈希值的二进制文件

[英]Running builds (gcc, make, cmake) inside identical docker, from same source gives binaries with different hashes

原文 2021-03-05 08:18:11 6 2 c++/ c/ gcc/ makefile/ cmake

I run into "interesting" issue.我遇到了“有趣”的问题。 I am doing build automation for our project in Bamboo.我正在为我们的 Bamboo 项目进行构建自动化。 I was quite sure that I am done and then someone asked: why builds from Friday night and Saturday night (no code changes) are different?我很确定我已经完成了，然后有人问：为什么周五晚上和周六晚上的构建（没有代码更改）不同？ I have 2 remote builders.我有 2 个远程构建器。 Both have same OS installed (Ubuntu) and updated at to the latest at the same time.两者都安装了相同的操作系统（Ubuntu）并同时更新到最新版本。 Both has the same libraries installed.两者都安装了相同的库。 The compilation is inside docker (image imported from same source) So I started looking into this and got to the point where I can observer the following:编译在 docker 内（从同一来源导入的图像）所以我开始研究这个并达到了可以观察以下内容的地步：

running compilation twice from same source on the same machine, starting new docker for each compilation produces identical (as per sha1sum) binaries.在同一台机器上从同一源运行编译两次，为每个编译启动新的 docker 会产生相同的（根据 sha1sum）二进制文件。
running compilation twice from same source on two different machines, produces different binaries.在两台不同的机器上从相同的源代码运行两次编译，产生不同的二进制文件。 Source is in the folder of the same name and it is mounted into docker on the path with same name as well.源在同名文件夹中，它也安装在同名路径上的 docker 中。
running compilation on 1 PC with some HW spec, then taking the disk and connecting it to the different PC (with different HW spec) and running compilation from the same source again.在具有某些硬件规范的 1 台 PC 上运行编译，然后取出磁盘并将其连接到不同的 PC（具有不同的硬件规范）并再次从同一源运行编译。 Resulting binaries were identical.生成的二进制文件是相同的。

Is it possible that somehow the code depends on exact OS image?代码是否可能以某种方式依赖于确切的操作系统映像？ or any other OS attribute?或任何其他操作系统属性？ Any other idea?还有什么想法吗？

It feels like chasing ghosts...有追鬼的感觉……

EDIT: After trying to go step by step, I narrowed this down to cmake.编辑：在逐步尝试 go 之后，我将其缩小到 cmake。 That means: cmake made on two different machines differ (going to start 1-by-1 diffing now).这意味着：在两台不同机器上制造的 cmake 不同（现在开始 1-by-1 差异）。 If I put results of cmake of several machines and compile with make from there, I am always getting same binaries.如果我把几台机器的 cmake 的结果并从那里用 make 编译，我总是得到相同的二进制文件。 So I believe that the problem is the way cmakefiles are written not compilation itself.所以我认为问题在于编写 cmakefile 的方式而不是编译本身。

EDIT2: I now know that this is Qt 5.2.1 rcc being non-deterministic issue. EDIT2：我现在知道这是 Qt 5.2.1 rcc 是非确定性问题。 During cmake rcc is run and among others calculates some hasheh.在 cmake 期间运行 rcc 并计算一些哈希值。 Difference in those hashes is what is causing the whole thing to non-deterministic.这些哈希的差异是导致整个事情不确定的原因。 If I do cmake and take content of it to 3 different machines and run compilation (make) there I got 100% identical (as per sha1sum) results.如果我执行 cmake 并将其内容带到 3 台不同的机器上并运行编译（make），我得到 100% 相同的结果（根据 sha1sum）。 I think that settles it here.我认为这就解决了。 Now I need either convince project to upgrade to newer version of Qt where I know how to make rcc deterministic or I need to find how to make rcc deterministic in 5.2.1.现在我需要说服项目升级到更新版本的 Qt，我知道如何使 rcc 确定性，或者我需要找到如何在 5.2.1 中使 rcc 确定性。

2 个解决方案

If you started with identical OS images, then your tests suggest a post-image configuration step introduced a change.如果您从相同的操作系统映像开始，那么您的测试表明映像后配置步骤引入了更改。 Review that configuration.查看该配置。 A trivial example would be the hostname.一个简单的例子是主机名。 I would diff any intermediate build artifacts, for instance, config.h or whatever cmake writes its output.我会区分任何中间构建工件，例如 config.h 或任何 cmake 写入其 output。 Try run strings on two binaries (that differ), then diff that output to see if you learn something.尝试在两个二进制文件（不同的）上运行字符串，然后比较 output 看看你是否学到了一些东西。

https://tests.reproducible-builds.org/debian/index_issues.html might be very instructive, too. https://tests.reproducible-builds.org/debian/index_issues.html也可能很有启发性。

The results could be coincidence.结果可能是巧合。 Linking requires that all the required functions go into the executable, but the order is generally not constrained.链接要求将所有需要的函数 go 放入可执行文件中，但顺序一般不受限制。 This could very well depend on the order in which the object files appear on disk.这很可能取决于 object 文件出现在磁盘上的顺序。