Normalized, Deterministic OSX SDK tarball #10170

https://github.com/bitcoin/bitcoin/blob/master/doc/README_osx.md

The process to assemble the OSX SDK tarball needed by the gitian deterministic build process for OSX binaries currently generates a non-deterministic tarball.

We want to improve this by making the script normalize the content of the tarball. This means file order, usernames, timestamps and possibly other things need to be standardized (maybe to what was in the original DMG?). The end goal is to output a tarball that has the same sha256 hash no matter who runs the script.

This is an opportunity for non-C++ developers to contribute to Bitcoin Core development.

On the other hand, having it non-deterministic has an added benefit of being able to tell who is merely copying their SDK from someone else...

On the other hand, having it non-deterministic has an added benefit of being able to tell who is merely copying their SDK from someone else...

That only works as long as people are not aware. It's trivially bypassed by un-tarring and re-tarring.

Sure, I'm assuming no malice. If we were to assume malice, who knows if a signer is just re-signing someone else's assert file. :p

In any case a deterministic SDK tar means it can be checked on entry to gitian like other inputs, which is more of an advantage than that would be a disadvantage, IMO.

On the other hand, having it non-deterministic has an added benefit of being able to tell who is merely copying their SDK from someone else...

The bigger issue is the need to blindly trust the binary blobs you get from Apple. If you choose to use OSX you have no choice but to trust their binary blobs as you are using their hardware, their firmware, their operating system.

In any case a deterministic SDK tar means it can be checked on entry to gitian like other inputs, which is more of an advantage than that would be a disadvantage, IMO.

Exactly.

@wtogami has any progress on this been made?

I'm going to close this in favour of #18674, which should solve this issue.