[BUG] Packaged EFI debug identity varies across fresh build directories #28

New issue

Closed

opened 2026-09-12 16:43:06 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 16:43:06 +02:00

Owner

Summary

Two fresh builds with identical original bootloader sources, compiler and configuration produce different EFI bytes. The difference is confined to the CodeView PDB identifier, but it prevents accepting the complete non-kernel artifact equality required for a controlled kernel startup comparison.

Reproduction

Use Integration 381bccd87c5632e9d1af8aa9d0aca295cbc00e1f as build tooling and bootloader 55f2e5295adcff8215269ff694aabb85a276f122. Build and package the development appliance from fresh original checkouts in two separate directories with Rust/Cargo 1.93.0 and SOURCE_DATE_EPOCH=1789206335. Use the same original product graph and configuration; the recorded pair changes only kernel fec1113a259c3cfff7d2dd942409b7f3f9df5e64 to c94e9f6f50aa14e34d45bdda651678af22ee0c49.

Run the original build-all, package-appliance and build-disk-image stages once per side. Compare the packaged BOOTX64.EFI files, their PE sections and the CodeView record. Both completed pipelines are retained; no unchanged retry or byte normalization is used.

Expected and actual behavior

Equivalent non-kernel source and build inputs should produce identical non-kernel artifacts. Both EFI files are 169472 bytes, but their SHA-256 values are dd6cbe0b1e551464bdb2e530cce499b8a9114e87db27cca36f517972d6522b2e and 93603e49908e1dc9a1cdf40df03257b131cfe9fddb1a967fba4851f27b5eb913.

Exactly eight bytes differ, at file offsets 168848 through 168855, within the first half of the CodeView RSDS signature. The record age and PDB basename are identical. PE and debug-directory timestamps both equal the selected epoch. Executable text and relocation sections are identical; read-only data differs only in those signature bytes. The required whole-file equality audit returns 1. This does not establish a runtime failure or timing effect.

Environment and identity

Original tooling and bootloader revisions are given above; all other original product selections except the intended kernel pair match.
x86_64 host, development appliance, Rust/Cargo 1.93.0; rustc commit 254b59607d4417e9dffbc307138ae5c86280fe4c, bundled LLVM 21.1.8 COFF linker.
Release rustc uses -C strip=debuginfo. Its actual linker command still contains /DEBUG and /PDBALTPATH:%_PDB%, with distinct absolute object/output paths and no /pdbsourcepath.
Sequential fresh host pipelines, two Cargo jobs, fixed epoch; no VM or guest authority is involved.
No last known fully path-independent EFI build has been established.

Evidence and prior checks

Source/signature/kernel-extraction/compression audits pass. All 65 ELF/shared-object names match, and all 64 non-kernel ELF/shared objects are byte-identical. All 106 appliance output names match. Both authenticated embedded console fonts match the frozen source bytes. Original executable audits classify every successful execution route. Actual compile/link invocations emit no warnings; artifact-free Cargo UEFI capability queries retain unsupported-crate-type warnings separately.

The field mapping and byte difference are observed directly. Path-sensitive linker-generated PDB content is a hypothesis requiring a focused original-source experiment. LLVM documents how linker paths can affect PDB identity and the requirements for directory-independent outputs: deterministic builds with clang and lld. Rust's compiler remapping does not cover all linker-generated paths: rustc source-path remapping.

The first focused profile-only correction (debug=false, strip=symbols) still emitted a 28-byte CodeView debug directory and matching PDB. The build succeeded, but the artifact checker failed and stopped the remaining builds. That result remains retained.

A build-script correction is signed and published as Bootloader 1563a4d9a5d523aa866896e13eb7fdc6ae728fb2 in Bootloader PR #3. It emits the per-binary /DEBUG:NONE only for UEFI and Cargo's effective DEBUG=false, preserving development and deliberate release diagnostics. All 14 strict Rust checks, 35 Python cases and seven fresh UEFI builds pass with Rust 1.93.0 and the original Integration helper above. Each release pair is entirely byte-identical across fresh source/output directories: default 155648 bytes, SHA-256 c0f42ae79e48e99666870fe813022b1a9aa8884b0d8d43aefcada5ba1ef8db87; console 169472 bytes, SHA-256 30a9b11feba8fdbc452ff2478c0cc6a5ae6134c2d9eb8ad5bb25d9fd67154282. All release outputs lack PDBs, PE debug-directory entries and COFF symbols. Both development pairs and the deliberate release diagnostic pair retain matching PDB GUID/age.

These standalone results precede the complete image verification below. The original failed image pair remains retained, and capability-query warnings remain separate from actual compilation.

The corrected original Bootloader 1563a4d9a5d523aa866896e13eb7fdc6ae728fb2 passes a new complete fresh host image pair with the original Integration 381bccd87c5632e9d1af8aa9d0aca295cbc00e1f, Rust/Cargo 1.93.0, epoch and kernel comparison above. Both build-all, package-appliance and build-disk-image pipelines succeed. All 106 appliance names match; all 64 non-kernel ELF/shared objects and the entire 169472-byte packaged EFI are identical. Both EFI hashes are 30a9b11feba8fdbc452ff2478c0cc6a5ae6134c2d9eb8ad5bb25d9fd67154282, with no release debug directory, COFF symbols or PDB. No bytes are normalized; development diagnostics remain separately available.

Manifest inventories, authenticated fonts, runtime graph, signatures and compression checks pass. Only the kernel and its derived manifests/packages/images differ. Both disk images are 138412032 bytes: baseline SHA-256 70f144f91b36536e4a9a9e7b2fe06272bb8aa47ea7a007664c0501d070878cd8; candidate 26afdadbe229e97baa9fd57a2331fd535a01269d27845749f1eb0a8f691806cc. All 12331 selected source/tool inputs are reverified. Final independent review hashes the complete 212-file output inventory and directly compares all 93 unchanged file pairs. This is host artifact evidence; no guest timing or full build within EriX is established.

The fix is in Bootloader PR #3. Bootloader 8cb4383699c47812f64f086f54da6b2a7b9e9133 adds only CI source preparation, its tests and status documentation to that runtime; both CI 133/134 pass. Docs 3fd9a53548a45967948c0000fa9465c96330ee95 publishes the release/debug policy with successful CI 817/818. Earlier failures remain retained. A private paired-audit launcher field error was corrected before its three previously unexecuted checks continued; no pipeline or completed audit was replayed. Actual compile/link warning invocations remain zero, but two artifact-free UEFI capability probes per side retain warnings. The literal all-invocation warning requirement remains open.

Tracking

Related direct ELF coordinate defect: Integration #22; profiler: Integration #3; whole-codebase audit: Integration #2; implementation: WIP PR #12.

The release/debug policy, corrected original recipe, focused cross-directory regression and complete fresh paired artifact verification resolve this scoped EFI identity defect. Guest profiling remains open in Integration #3, alongside the broader warning and self-hosting requirements.

## Summary Two fresh builds with identical original bootloader sources, compiler and configuration produce different EFI bytes. The difference is confined to the CodeView PDB identifier, but it prevents accepting the complete non-kernel artifact equality required for a controlled kernel startup comparison. ## Reproduction Use Integration `381bccd87c5632e9d1af8aa9d0aca295cbc00e1f` as build tooling and bootloader `55f2e5295adcff8215269ff694aabb85a276f122`. Build and package the development appliance from fresh original checkouts in two separate directories with Rust/Cargo 1.93.0 and SOURCE_DATE_EPOCH=1789206335. Use the same original product graph and configuration; the recorded pair changes only kernel `fec1113a259c3cfff7d2dd942409b7f3f9df5e64` to `c94e9f6f50aa14e34d45bdda651678af22ee0c49`. Run the original build-all, package-appliance and build-disk-image stages once per side. Compare the packaged BOOTX64.EFI files, their PE sections and the CodeView record. Both completed pipelines are retained; no unchanged retry or byte normalization is used. ## Expected and actual behavior Equivalent non-kernel source and build inputs should produce identical non-kernel artifacts. Both EFI files are 169472 bytes, but their SHA-256 values are `dd6cbe0b1e551464bdb2e530cce499b8a9114e87db27cca36f517972d6522b2e` and `93603e49908e1dc9a1cdf40df03257b131cfe9fddb1a967fba4851f27b5eb913`. Exactly eight bytes differ, at file offsets 168848 through 168855, within the first half of the CodeView RSDS signature. The record age and PDB basename are identical. PE and debug-directory timestamps both equal the selected epoch. Executable text and relocation sections are identical; read-only data differs only in those signature bytes. The required whole-file equality audit returns 1. This does not establish a runtime failure or timing effect. ## Environment and identity - Original tooling and bootloader revisions are given above; all other original product selections except the intended kernel pair match. - x86_64 host, development appliance, Rust/Cargo 1.93.0; rustc commit `254b59607d4417e9dffbc307138ae5c86280fe4c`, bundled LLVM 21.1.8 COFF linker. - Release rustc uses `-C strip=debuginfo`. Its actual linker command still contains `/DEBUG` and `/PDBALTPATH:%_PDB%`, with distinct absolute object/output paths and no `/pdbsourcepath`. - Sequential fresh host pipelines, two Cargo jobs, fixed epoch; no VM or guest authority is involved. - No last known fully path-independent EFI build has been established. ## Evidence and prior checks Source/signature/kernel-extraction/compression audits pass. All 65 ELF/shared-object names match, and all 64 non-kernel ELF/shared objects are byte-identical. All 106 appliance output names match. Both authenticated embedded console fonts match the frozen source bytes. Original executable audits classify every successful execution route. Actual compile/link invocations emit no warnings; artifact-free Cargo UEFI capability queries retain unsupported-crate-type warnings separately. The field mapping and byte difference are observed directly. Path-sensitive linker-generated PDB content is a hypothesis requiring a focused original-source experiment. LLVM documents how linker paths can affect PDB identity and the requirements for directory-independent outputs: [deterministic builds with clang and lld](https://blog.llvm.org/2019/11/deterministic-builds-with-clang-and-lld.html). Rust's compiler remapping does not cover all linker-generated paths: [rustc source-path remapping](https://doc.rust-lang.org/rustc/remap-source-paths.html). The first focused profile-only correction (`debug=false`, `strip=symbols`) still emitted a 28-byte CodeView debug directory and matching PDB. The build succeeded, but the artifact checker failed and stopped the remaining builds. That result remains retained. A build-script correction is signed and published as Bootloader `1563a4d9a5d523aa866896e13eb7fdc6ae728fb2` in [Bootloader PR #3](https://git.erikinkinen.fi/erix/bootloader/pulls/3). It emits the per-binary `/DEBUG:NONE` only for UEFI and Cargo's effective `DEBUG=false`, preserving development and deliberate release diagnostics. All 14 strict Rust checks, 35 Python cases and seven fresh UEFI builds pass with Rust 1.93.0 and the original Integration helper above. Each release pair is entirely byte-identical across fresh source/output directories: default 155648 bytes, SHA-256 `c0f42ae79e48e99666870fe813022b1a9aa8884b0d8d43aefcada5ba1ef8db87`; console 169472 bytes, SHA-256 `30a9b11feba8fdbc452ff2478c0cc6a5ae6134c2d9eb8ad5bb25d9fd67154282`. All release outputs lack PDBs, PE debug-directory entries and COFF symbols. Both development pairs and the deliberate release diagnostic pair retain matching PDB GUID/age. These standalone results precede the complete image verification below. The original failed image pair remains retained, and capability-query warnings remain separate from actual compilation. The corrected original Bootloader `1563a4d9a5d523aa866896e13eb7fdc6ae728fb2` passes a new complete fresh host image pair with the original Integration `381bccd87c5632e9d1af8aa9d0aca295cbc00e1f`, Rust/Cargo 1.93.0, epoch and kernel comparison above. Both build-all, package-appliance and build-disk-image pipelines succeed. All 106 appliance names match; all 64 non-kernel ELF/shared objects and the entire 169472-byte packaged EFI are identical. Both EFI hashes are `30a9b11feba8fdbc452ff2478c0cc6a5ae6134c2d9eb8ad5bb25d9fd67154282`, with no release debug directory, COFF symbols or PDB. No bytes are normalized; development diagnostics remain separately available. Manifest inventories, authenticated fonts, runtime graph, signatures and compression checks pass. Only the kernel and its derived manifests/packages/images differ. Both disk images are 138412032 bytes: baseline SHA-256 `70f144f91b36536e4a9a9e7b2fe06272bb8aa47ea7a007664c0501d070878cd8`; candidate `26afdadbe229e97baa9fd57a2331fd535a01269d27845749f1eb0a8f691806cc`. All 12331 selected source/tool inputs are reverified. Final independent review hashes the complete 212-file output inventory and directly compares all 93 unchanged file pairs. This is host artifact evidence; no guest timing or full build within EriX is established. The fix is in [Bootloader PR #3](https://git.erikinkinen.fi/erix/bootloader/pulls/3). Bootloader `8cb4383699c47812f64f086f54da6b2a7b9e9133` adds only CI source preparation, its tests and status documentation to that runtime; both CI 133/134 pass. Docs `3fd9a53548a45967948c0000fa9465c96330ee95` publishes the release/debug policy with successful CI 817/818. Earlier failures remain retained. A private paired-audit launcher field error was corrected before its three previously unexecuted checks continued; no pipeline or completed audit was replayed. Actual compile/link warning invocations remain zero, but two artifact-free UEFI capability probes per side retain warnings. The literal all-invocation warning requirement remains open. ## Tracking Related direct ELF coordinate defect: [Integration #22](https://git.erikinkinen.fi/erix/integration/issues/22); profiler: [Integration #3](https://git.erikinkinen.fi/erix/integration/issues/3); whole-codebase audit: [Integration #2](https://git.erikinkinen.fi/erix/integration/issues/2); implementation: [WIP PR #12](https://git.erikinkinen.fi/erix/integration/pulls/12). The release/debug policy, corrected original recipe, focused cross-directory regression and complete fresh paired artifact verification resolve this scoped EFI identity defect. Guest profiling remains open in [Integration #3](https://git.erikinkinen.fi/erix/integration/issues/3), alongside the broader warning and self-hosting requirements.

erikinkinen added the

performance

phase-6

bug

labels

2026-09-12 16:43:06 +02:00

~~erikinkinen referenced this issue 2026-09-12 16:54:38 +02:00~~

WIP: Coordinate native authority, shell workspace and source transport #12

erikinkinen referenced this issue

2026-09-12 16:54:39 +02:00

[BUG] Direct runtime artifact bytes vary with checkout paths #22

~~erikinkinen referenced this issue from erix/bootloader 2026-09-12 18:08:39 +02:00~~