4 ms·
This is really important work, hopefully it is completed as soon as possible. It basically allows multiple reputable people to independently build the code and
by devit 11y ago
This is really important work, hopefully it is completed as soon as possible.
It basically allows multiple reputable people to independently build the code and sign a statement that a given source code hash produces a given binary hash (and that the source code hash is the correct one for a given package), and have the presence of at least a certain amount of these signatures be verified on package installation.
This means that it will no longer be possible to backdoor Debian without changing source code by compromising the main build infrastructure.