4 ms·
Does anyone diff public releases with builds done using a known good environment? It would be a lot of work but could expose malicious providers. Then again i
by keanebean86 8y ago
Does anyone diff public releases with builds done using a known good environment?
It would be a lot of work but could expose malicious providers.
Then again it might be hard to create an actual good environment considering all the software /firmware/hardware layers modern systems have.
- orblivion 8y agoSee here for an example: https://gitian.org/ https://gitian.org/. As I understand it's used to build a (the?) Bitcoin client.
- kpcyrd 8y agoYes, this is known as a rebuilder. There is still work to be done, but NYU was one of the organizations working on developing and running a rebuilder. The idea is that you pull buildinfo files from https://buildinfo.debian.net/ https://buildinfo.debian.net/, then try to verify them and if you got the same artifact you sign that you successfully verified this binary package. A user could then configure "I trust rebuilder X, Y, Z and I require that at least N have successfully verified the package" before installing it.