builds of openmpi are not yet reproducible

[bmwiedemann]

Background information

What version of Open MPI are you using?

1.10.7 on openSUSE Tumbleweed (aka Factory)

Details of the problem

For https://reproducible-builds.org/ I tried to build packages of openmpi twice and found various diffs in the binaries.

One source of such diffs should be removed by
#3756

But there are still invocations of

`date`
`hostname`

in
openmpi-1.10.7/autogen.pl
openmpi-1.10.7/config/opal_functions.m4
openmpi-1.10.7/config/opal_get_version.m4
openmpi-1.10.7/ompi/tools/ompi_info/Makefile.am
openmpi-1.10.7/orte/tools/orte-info/Makefile.am
openmpi-1.10.7/oshmem/tools/oshmem_info/Makefile.am

master also has
ompi/tools/mpisync/Makefile.am
opal/mca/pmix/pmix2x/pmix/config/pmix_functions.m4
opal/mca/pmix/pmix2x/pmix/config/pmix_get_version.sh

Would be nice if those date usages could be either dropped or use the SOURCE_DATE_EPOCH environment var to override the current time (see examples in https://wiki.debian.org/ReproducibleBuilds/TimestampsProposal#Bash_.2F_POSIX_shell )

[jsquyres]

I think we'd be amenable to $SOURCE_DATE_EPOCH in the way it is described in the page you sent (i.e., if it's set, use it, otherwise, use the same date mechanisms we've been using). Could you post another PR?

(the PMIX stuff will be submitted upstream to PMIX -- but they copy a lot of their build system / methodology from us, so they'll likely be amenable, too)

FWIW: the hostname usage (and date usage, for that matter) are mostly an issue of logging -- e.g., ompi_info shows the build date and hostname. This can be helpful in debugging, for example, if a user builds on one machine but then tries to run on an different machine with a different / incompatible set of userspace libraries, etc. I understand why a distro, for example, would want to have the same build date for all of its software; using $SOURCE_DATE_EPOCH seems like a fine solution.

Is there a $SOURCE_DATE_EPOCH analog for hostname? I.e., does a reproducible build require identical builds on different machines?

[rhc54]

Yeah, we'll take it upstream to PMIx. If it doesn't already exist, perhaps something like $SOURCE_HOSTNAME?

[ggouaillardet]

i already started implementing this, and i will likely PR today

[bmwiedemann]

On 2017-06-27 16:37, Jeff Squyres wrote: Is there a |$SOURCE_DATE_EPOCH| analog for |hostname|? I.e., does a reproducible build require identical builds on different machines?

one common approach I have seen is to re-use $SOURCE_DATE_EPOCH as an indicator for 'someone wants the build to be reproducible' e.g. ```bash if [ -n "$SOURCE_DATE_EPOCH" ] ; then hostname=someconstant fi ```

[jsquyres]

@bmwiedemann Ralph suggested $SOURCE_HOSTNAME -- does that work for you? Otherwise, we wouldn't know what to pick for someconstant.

[bmwiedemann]

The disadvantage of an extra variable is that a dozen distributions would have to discover and use it then, while $SOURCE_DATE_EPOCH is already well-established.

I usually use hostname=reproducible to indicate that it is not the real build hostname

[bmwiedemann]

https://www.zq1.de/~bernhard/temp/openmpi-reproducible-patch.txt is my test-patch that made the build fully reproducible, but I considered too unclean to upstream in this form.

[jsquyres]

@bmwiedemann Just to be sure I understand: you're suggesting using $hostname and not $SOURCE_HOSTNAME, right?

Be sure to see #3779, too (but it doesn't [yet] include anything for hostname).

[bmwiedemann]

I meant: do not use an extra variable to signify that the build should override the hostname, but look at the existance of $SOURCE_DATE_EPOCH for that.

[jsquyres]

@bmwiedemann I have to admit that that's a bit weird to me. I can see the argument of using $SOURCE_DATE_EPOCH because that's a value that's at least rooted in some reality / some user choice. But if we arbitrarily pick a non-existent hostname, that seems counter to the point, doesn't it? It would also defeat the point of having a hostname at all.

Do reproducible builds have to produce exactly the same output when run on multiple different servers? Or just at different times on the same server?

[rhc54]

That seems a little ugly as it requires one infer some intent of the user that may not exist. However, I don't feel strongly about it. I would, though, suggest that somebody in the distro world fix the ambiguity by creating a separate variable.

[bmwiedemann]

@jsquyres we have a build farm for openSUSE and the idea is to be able to (re)create identical binaries on any of the build hosts. (otherwise we have to re-publish build results to the mirrors and users wasting their bandwidth when nothing in the code actually changed)
At the moment, rpm metadata still contain the actual build hostname and a specialized compare script ignores that. But in a few years, we might be at a point when we do not need that anymore, because rpms themselves will be identical bit-by-bit no matter where and when they were built.
And the funny thing is that then you do not need to store time and place of the build anymore.