3 ms·

Can you verify the binaries by reproducing them and comparing hashes? (obviously not of the whole binary but maybe some portion) That would protect the users o

Can you verify the binaries by reproducing them and comparing hashes? (obviously not of the whole binary but maybe some portion) That would protect the users of those binaries.

rocqua 10y ago
Deterministic compilation isn't commonplace yet. I'm not even sure if it's really usable at all yet. Generally, we rely on signed binaries.
- sleepychu 10y ago
  So the signature gives you confidence because you trust the signatory?
  - rocqua 10y ago
    Yes, or more specifically, because I trust the keys published by the developers are controlled only by the developers, and because I trust the developers to compile correctly.