ECE 441 · Week 10
Modern Computer: Secure Infrastructure
The report and the reproduction package carry the week-5 method, the week-4 build hash with its rebuild commands, and the week-6 peer note.
Week 10 of 10 · Solitude
ECE 441 · Week 10 · In class
The report and the reproduction package carry the week-5 method, the week-4 build hash with its rebuild commands, and the week-6 peer note.
- A student who was not in the section rebuilds the bootloader from the package and gets the same hash.
- The report is for that student.
- The three filenames are the names of those three items inside the package.
- Write the audience sentence and the three filenames before you pack.
ECE 441 · Week 10 · In class
The report and the reproduction package carry the week-5 method, the week-4 build hash with its rebuild commands, and the week-6 peer note. (continued)
- That pair is the homework.
ECE 441 · Week 10 · In class
Unpack the package on the bench PC, rebuild from it, and confirm the image hash matches week 4's.
- The report is individual even when a bench is shared.
ECE 441 · Week 10 · Lecture
Written for someone who was not here
- The reader has the package, a bench like yours, and none of your memory.
- They rebuild the bootloader from the package and get the week-4 hash, or the package is incomplete.
- The package carries the week-5 method, the week-4 hash with its rebuild commands, and the week-6 peer note.
ECE 441 · Week 10 · Lecture
What the package must pin
| Item | Why |
|---|---|
| Source commit | Which code was built |
| Toolchain name and version | Which compiler made the bytes |
SOURCE_DATE_EPOCH value | Which date the image carries |
| Rebuild commands, in order | How to get from source to image |
| Expected SHA-256 | What "the same bytes" means |
ECE 441 · Week 10 · Lecture
Packing it so the package is reproducible too
tar --sort=name --mtime=@"$SOURCE_DATE_EPOCH" \
--owner=0 --group=0 --numeric-owner \
-cf package.tar package/
gzip -n package.tar
sha256sum package.tar.gz- Sorted names, a fixed time, and fixed owners make two packs of the same files match.
gzip -nleaves out the file name and time stamp gzip would otherwise store.
ECE 441 · Week 10 · Lecture
Checking the rebuild against the hash
sha256sum <rebuilt-image>
echo "<expected-hash> <rebuilt-image>" | sha256sum -csha256sum -cprintsOKorFAILEDper file: no eye-comparing 64 hex digits.- Two spaces between hash and name: that is the format
sha256sumwrites and reads. - A mismatch goes in the report with its first difference, found the week-4 way.
ECE 441 · Week 10 · Lecture
The report's sections
- What was done and on what board: one paragraph.
- Method: the week-5 sheet, as the peer ran it.
- Results: the hashes, the peer note, what matched and what did not.
- How to reproduce: the package, step by step.
- Limits: what was not checked, stated plainly.
ECE 441 · Week 10 · Lab
Lab
- Write the report and pack the method, the build hash with its rebuild commands, and the peer note so a student who was not in the section can repeat the work.
- Second pass: unpack the package on the bench PC, rebuild from it, and confirm the image hash matches the week-4 hash.
ECE 441 · Week 10 · Lab
Lab (continued)
- Assemble the lab hand-in: The paper-style report and the reproduction package containing the week-5 method, the week-4 build hash with its rebuild commands, and the week-6 peer note.
ECE 441 · Week 10 · Lab
Hand in
The paper-style report and the reproduction package containing the week-5 method, the week-4 build hash with its rebuild commands, and the week-6 peer note.
ECE 441 · Week 10 · Homework
Homework
- Write who the report is for, in one sentence, and the three filenames the package must contain.
ECE 441 · Week 10 · Homework
Turn in
The audience sentence and the three filenames.
ECE 441 · Week 10 · Read
Read
On the lab site: Module 12, A whole system, has no paper and no reproduction package. This week is past Module 12.