3 ms·
In the context of "reproducible builds", it means that if you compile the same source code with the same compiler and build system, the output will be completel
by cesarb 9y ago
In the context of "reproducible builds", it means that if you compile the same source code with the same compiler and build system, the output will be completely identical, bit by bit. This is surprisingly hard to achieve in practice.
Once they have reproducible builds, they can easily prove that each binary package was built from the corresponding source code package: just have a third party compile the source code again and generate the binary package, and it should be identical (except for the signature). This reduces the need to trust that the build machines haven't been compromised.
- kobeya 9y agoJust piggybacking on this comment, you can do a whole lot more than just trust that a few people have automated. Most people in Ubuntu get non-distro packages from Launchpad, for example, which uses their own build servers. With reproducible builds you can require BOTH launchpad and the developer's signature for a package to be valid, which tremendously improves the security situation.
- kobeya 9y ago* trust that a few people have audited. (Damn autocorrect.)