fix: root-cause the macOS reproducibility false-MISMATCH (TMPDIR symlink aliasing) - #87
Merged
Merged
Conversation
…ink aliasing) Controlled experiment: same clone, same SDK 10.0.400, clean obj — packing with cwd inside the clone matched the published DLL byte-for-byte; the script's invocation mismatched by exactly 476 bytes, all in the PE timestamp / MVID / debug-stamp regions (hash-derived, code identical). Diffing the real csc args exposed the cause: on macOS, mktemp -d returns /var/folders/... whose /var is a symlink to /private/var. Built through the unresolved spelling, SourceLink's computed source root (/var/...) disagreed with the compiler's canonical source paths (/private/var/...), so the /_/ path map never applied, absolute paths leaked into the deterministic input hash, and a byte-perfect package was reported MISMATCH. The earlier external macOS-reproducibility report had the same cause. Fix: canonicalize the work dir (pwd -P). Verified: core AND Hybrid v1.7.1 now verify MATCH on macOS arm64 — so the published packages are proven byte-identical across Linux x64 (release CI), Linux arm64, and macOS arm64, and REPRODUCIBLE-BUILDS.md replaces the retracted cross-OS claim with the proven one plus the verify-from-a-physical-path guidance. Also corrected: AUDIT-SCOPE.md pinned the v1.7.1 annotated-tag OBJECT hash (e0d332a) as the commit; the actual commit is f062c10. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sym7RJ7ehNhbMXytE5rMmS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last open investigation, closed — and the answer upgrades a public assurance claim.
The experiment
Same clone, same SDK 10.0.400, clean
obj: cwd inside the clone → byte-identical with nuget.org; the script's invocation → mismatch of exactly 476 bytes, all in PE timestamp/MVID/debug-stamp regions (hash-derived; code identical). Diffing the realcscarguments found it:/pathmap:"…,/private/var/folders/…/src/=/_/"/pathmap:"…,/var/folders/…/src/=/_/"macOS's
/var → /private/varsymlink:mktemp -dhands back the aliased spelling, SourceLink computes the source root from it, the compiler enumerates sources under the canonical path, the/_/map never applies, and absolute paths leak into the deterministic input hash. A byte-perfect package was reported MISMATCH. The earlier external macOS report had the same cause.The fix
One line: canonicalize the work dir (
pwd -P).The upgraded claim
Core and Hybrid v1.7.1 now verify MATCH on macOS arm64 — the published packages are proven byte-identical across Linux x64 (release CI), Linux arm64 (container), and macOS arm64. REPRODUCIBLE-BUILDS.md replaces the retracted cross-OS claim with the proven one plus verify-from-a-physical-path guidance.
Also corrected: AUDIT-SCOPE.md had pinned the v1.7.1 annotated-tag object hash as the commit; now names the real commit
f062c10.🤖 Generated with Claude Code
https://claude.ai/code/session_01Sym7RJ7ehNhbMXytE5rMmS