3 ms·

We need a body/service that verifies that the code-binary combo being distributed by a developer is actually reproducible. Because, most users don't have the ti

We need a body/service that verifies that the code-binary combo being distributed by a developer is actually reproducible. Because, most users don't have the time or resources to verify each package they use. But its useful to society if distributed packages are reproducible. So a trusted third party should provide this service. I would envisage it working in the following way. The developer submits links to their code and links to their package. The service builds from code and checks if the final package matches what is being distributed by the developer. If yes, it then publishes the hashes of the code and package, so users can quickly check that they are using a reproducibly built package from the correct source.

Foxboron 8y ago
This is being actively worked on and already has had quite a bit of work. This project is also submitted to Google summer of code under the Debian project. https://ssl.engineering.nyu.edu/blog/2019-01-18-in-toto-paris https://ssl.engineering.nyu.edu/blog/2019-01-18-in-toto-pari... https://salsa.debian.org/reproducible-builds/debian-rebuilder-setup https://salsa.debian.org/reproducible-builds/debian-rebuilde... https://github.com/in-toto/apt-transport-in-toto https://github.com/in-toto/apt-transport-in-toto https://reproducible-builds.org/docs/sharing-certifications/ https://reproducible-builds.org/docs/sharing-certifications/
sigmar 8y ago
The way F-Droid (android app distribution service) does this is all builds are done server-side (devs only update the publicly available source) and then anyone can quickly setup a verification server that builds+diffs the packages https://verification.f-droid.org https://verification.f-droid.org