Arch Linux User Repository

Good news: BinDiff 8 has been released as open source!

Bad news: Building the GUI requires a proprietary library whose functionality is not easily replaced by any FOSS library, so it's unlikely we'll be able to build the entire BinDiff package (including the GUI) from source any time soon.

For the moment, to get the package updated ASAP, I'm going to continue to use the pre-built Debian package as the source. Once the package is updated, I'll work on updating the PKGBUILD to replace the pre-built native binaries with binaries built from source, enabling the package to be installed on architectures other than just x86_64. And then once all of that's done, if people want me to I can split the package into two: One for just the native binaries that will be built from source, and the other for just the partly-proprietary GUI JAR that will be extracted from the pre-built package.

If that all sounds good, or if you think things should be done differently, please feel free to let me know in the comments.

@stoked-security Thanks for letting me know about the StartupWMClass issue--I've modified the PKGBUILD to fix that issue.

Regarding the issue with binexport only being able to be built with Java 21, this is pretty common with Ghidra plugins--they generally only want to be built with the same version of Java as Ghidra was, and currently that version is Java 21. But building with Java 21 is pretty straightforward: Assuming you already have jdk21-openjdk installed, before running gradle just set your path with export PATH="/usr/lib/jvm/java-21-openjdk/bin:${PATH}". That will ensure that the Java 21 JDK is used to build the plugin.

As for creating a package for binexport, I'm not sure I'd want to maintain that, especially since I'd have to bump the pkgrel on every update to the ghidra package (because Ghidra won't load the plugin if it was built for a different version of Ghidra).

The StartupWMClass line in the .desktop file lists the wrong WM_CLASS name, preventing the Bindiff icon from being shown in the Gnome task manager. The correct value should be:

com-google-security-zynamics-bindiff-BinDiff

Could you please update the .desktop file?

Also, there is a known bug that prevents the binexport plugin for Ghidra from running due to a protobuf version mismatch: https://github.com/google/binexport/issues/144

The issue has been solved (sort of) but no new binexport version has been released since. I worked around this by checking out the main code and compiling the code in the java subdirectory myself. However, the Java version check at the beginning of the build.gradle checks for a specific Java language version instead of minimal version. I have not succeeded in modifying the check into checking that at least Java version 21 is used instead of just version 21. My gradle knowledge is quite limited, so for now changed the version to 25 manually. This allowed me to built the plugin and use it in Ghidra without errors.

I know that compiling from source for bindiff is difficult due to missing libraries, but maybe it is possible to create a separate binexport package as a dependency? The Java version check would have to be relaxed a bit, but at least it would be able to produce a working bindiff pluging for Ghidra. I haven't checked IDA and BinaryNinja plugins yet, so no idea of these are broken as well.

Good news: BinDiff 8 has been released as open source!

Bad news: Building the GUI requires a proprietary library whose functionality is not easily replaced by any FOSS library, so it's unlikely we'll be able to build the entire BinDiff package (including the GUI) from source any time soon.

For the moment, to get the package updated ASAP, I'm going to continue to use the pre-built Debian package as the source. Once the package is updated, I'll work on updating the PKGBUILD to replace the pre-built native binaries with binaries built from source, enabling the package to be installed on architectures other than just x86_64. And then once all of that's done, if people want me to I can split the package into two: One for just the native binaries that will be built from source, and the other for just the partly-proprietary GUI JAR that will be extracted from the pre-built package.

If that all sounds good, or if you think things should be done differently, please feel free to let me know in the comments.

should be bindiff-bin

The latest version fails validation:

==> Making package: bindiff 7-3 (Sun 31 Jul 2022 01:32:24 PM IDT)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
  -> Found bindiff_7_amd64.deb
  -> Found bindiff_7_amd64.deb.asc
==> Validating source files with sha256sums...
    bindiff_7_amd64.deb ... FAILED
    bindiff_7_amd64.deb.asc ... Skipped
==> ERROR: One or more files did not pass the validity check!
 -> error making: bindiff

I had to import the keys via:

curl https://dl.google.com/linux/linux_signing_key.pub | gpg --import -

@uzer I'd already figured out where the correct link was, but the package is still out of date. Bindiff is on version 6, so changing the version number to 6 and changing the source urls to the correct one like in your patch (and fixing the sha256sum, the pgp key doesn't need changing) is necessary to bring this package up to date.

@gardot426 My patch below addresses this problem.

-source=("https://dl.google.com/dl/zynamics/bindiff_${pkgver}_amd64.deb"{,.asc})
+source=("https://storage.googleapis.com/bindiff-releases/bindiff_${pkgver}_amd64.deb"{,.asc})

This package is completely broken. The sources lead to dead links.