2 ms·
Seems like package hashes could be stored in a block chain to prevent modification by certain three letter agencies and other non-benign actors.
by MR4D 10y ago
Seems like package hashes could be stored in a block chain to prevent modification by certain three letter agencies and other non-benign actors.
- hannob 10y agoThat's basically the idea of binary transparency (which is a bit stalled right now, but people are aware that this would be a good move). BT is a complement to reproducible builds, not a replacement.
- andrewflnr 10y agoWell, yeah, obviously you need a deterministic build before you can have a meaningful hash to store on your blockchain.
- heavenlyhash 10y agoDisagree :) We don't need repro to start logging what we build! We should start logging what we build so it's an incentive to get repro results :) Reproducible builds are a pursuit. You can never "prove" yo have them: only keep checking and be vigilant. So it's best to start logging now, and then keep putting in the work to make sure it's "meaningful".