7 ms·

Trust is good, control is better: Reproducible builds at F-Droid

194 points by ericdanielski 7y ago

75dvtwin 7y ago
WRT to this bit: > truly every single app is built from source and therefore F-Droid’s build infrastructure is highly secured, with only Ciaran Gultnieks, who founded the project almost nine years ago, having access to it. What assurances (including legal) are there (besides best intentions) that Ciaran Gultnieks is the only one that has access to the infrastructure that builds F-droid? Also what happens if Ciaran no longer works on the project?
- rectang 7y ago
  > what happens if Ciaran no longer works on the project? You get a situation like QuadrigaCX when CEO Gerald Cotten passed away and 190 USD in bitcoin became unavailable. https://www.quadrigacxtrustee.com/ https://www.quadrigacxtrustee.com/ Or, to address the problem, something like Shamir's Secret Sharing algorithm could help.
  - Avamander 7y ago
    I don't know why the downvotes, the bus factor in this case is 1 and that's horrible.
    - codewiz 7y ago
      Where does HN display the downvote count for a post?
      - ardani 7y ago
        I don't think downvote counts are shown, even to high-karma posters.
      - vinceguidry 7y ago
        You can get a sense for how much a post is being downvoted by the shade of gray the post is displayed with. The closer to white, the more downvotes. HN stopped greying out your own posts, so it's not easy to determine exactly how the behavior is implemented. Personally, I find the greying of a post on even a single downvote to be quite unfortunate and easily abused. I feel a post should only start greying on the second downvote.
        brewdad 7y ago
        I find it useful and will upvote gray posts that I feel have been downvoted over disagreement rather than truly deserving the downvote. It's probably my most common reason for upvoting.
        akerl_ 7y ago
        It’s potentially worth noting that downvoting over disagreement is considered in-line with the rules: https://news.ycombinator.com/item?id=17996858 https://news.ycombinator.com/item?id=17996858
  - MaxBarraclough 7y ago
    $190m. Better source: https://www.theguardian.com/technology/2019/feb/04/quadrigacx-canada-cryptocurrency-exchange-locked-gerald-cotten https://www.theguardian.com/technology/2019/feb/04/quadrigac...
- zimbatm 7y ago
  Because the builds are reproducible, it means that anyone can re-build the projects and verify that the output is the same, independently. That's the beauty of it, it's the only system that doesn't need a chain of trust. That being said, I don't know enough about the project to say if there are actually people doing the verification work.
  - akerl_ 7y ago
    I think it would be more precise to say that reproducible builds rely on asynchronous trust: individual users trust the pre-built packages on the expectation that some users are building from source and comparing against the package results. It’s worth noting here that it’s not sufficient for some users to build from source for their own usage: they have to additionally compare their build results against the version served by the repository, and then they have to publicize if there’s a mismatch. As somebody who builds many things from source, but has never attempted to validate a packaged repo using my results, I’m curious: does anybody here perform this validation?
    - bovine3dom 7y ago
      Mozilla's add-on reviewers do. I know because our build wasn't totally reproducible and they made us make it so.
Hitton 7y ago
The part about Signal is inaccurate. Signal actually offers reproducible builds on their website, they don't want to publish on F-Droid at this time precisely because it wouldn't be signed by their own key, but by F-Droid's which would now just add one more party who would have to be trusted.
- upofadown 7y ago
  How hard have the Signal people tried? The article specifically says that a reproducible build could be signed by the originator: >If Signal would be built reproducibly, everyone including F-Droid could check whether the app has been built straight from its source code and could then include it in F-Droid’s store
  - throwaway2048 7y ago
    Judging by signals history of apathy and hostility towards other open source projects and distributions, my guess would be "they haven't tried at all".
    - bubblethink 7y ago
      This attitude is tiring. F-droid is fine and appreciated, but I really wouldn't want anything critical (say a journalist or whistelblower) to depend on it. If you have to depend on f-droid doing builds, there are no guarantees (it's all best-effort). Firefox and its flavours are routinely outdated. Firefox klar(focus) was outdated for six months because they couldn't build it. Now, let's say that f-droid is poor and run by hobbyists, and upstream ought to do better FOSS builds. Even with that, they don't even have the bandwidth to serve packages. They have one main server which is routinely swamped. It's a struggle to download anything from f-droid reliably. They added mirrors recently, but the main server is still the bottleneck without which the mirrors are useless.
      - chacha2 7y ago
        So a journalist or whistle-blower should use Play Store instead? You can put any repository you want on F-Droid and it'll alert you when there's new updates, that's much better than just having the apk. > Firefox klar(focus) was outdated for six months because they couldn't build it. A build that can't be reproduced is also a security threat.
MYEUHD 7y ago
>the organization behind Signal forbids distributing other binaries than the ones signed by them. Isn't this a GPL violation?
- afiori 7y ago
  I believe this applies specifically to the Signal brand.
- mcny 7y ago
  No because GPL does not require you to open your network to anyone. My understanding is you can distribute Signal binaries but you'd have to connect it to your own servers so it is not Signal anymore... It is something based on Signal like whatsapp (which nobody wants)
  - thatcat 7y ago
    There was a Noise messaging app on copperhead os that connected to everyone though, I'm not sure how it worked.
  - MaxBarraclough 7y ago
    > No because GPL does not require you to open your network to anyone. I don't know what you meant by this, but MYEUHD is correct: you can't release software under GPL and then dictate the terms under which binaries may be distributed, beyond the relevant copyleft restrictions already imposed by the GPL. I'm not convinced that Signal attempt any such prohibition though. There's a discussion over here [0] on this question. Someone rightly points out Stallman's Freedom 2. [0] https://github.com/signalapp/Signal-Android/issues/282#issuecomment-21763403 https://github.com/signalapp/Signal-Android/issues/282#issue...
    - cwyers 7y ago
      Firefox distributes the source via an open source license, but if you want to distribute binaries, you can't use trademarks not covered by the source license without Mozilla's permission.
Avamander 7y ago
They should make reproducible builds mandatory and then sign over apks built by devs. That way they don't have to be trusted specifically and that's how it must be.
aasasd 7y ago
I feel like current understanding of reproducible builds stops short of solving the problem, particularly because I don't quite see users religiously building and comparing the packages, especially hundreds of them. A practical solution, IMO, would be several organizations running and publishing the builds—i.e. several independent F-Droids. Then, a few interested people could rather trivially automatically download the binaries and compare them. If one of the ‘stores’ gets compromised, a mismatch in binaries would indicate that. This implies that versions should be built fully automatically from updated sources, without action on the part of the authors that is specific to the stores. Edit: the idea of distributed builds, mentioned in the article, is similar—but IMO it's still unlikely that people will spend resources on apps that they personally don't use.
- brachi 7y ago
  but isn't the target users of F-droid developers? E.g. someone who could build things from scratch if they decide to go beyond trusting the signature?
  - ardani 7y ago
    Tech generally arrives in the consumer space only after becoming the standard for developers. Literal wizards, they build from source.
  - dTal 7y ago
    I don't think that's the case at all. F-Droid is very user-friendly. It supports advanced users, but then all software should.
  - aasasd 7y ago
    No. I myself use F-Droid, and my knowledge of Android development consists of editing a line in an XML file in AnkiDroid and rebuilding the app with Gradle like the readme says. And even if the share of nerds is higher among F-Droid users, I still don't think coders often go “wait, this app is open-source, let me build it myself instead of getting a binary.”
- Foxboron 7y ago
awinter-py 7y ago
I LOVE the idea of multi-signer reproducible builds F-droid feels incomplete to me -- open source + third party builds are still not enough, we need privacy linting and community code review to have any assurance of what these apps are doing. (But don't mean to dis, F-droid is IMO the best thing about mobile right now)
brachi 7y ago
I think this concept of reproducible builds is very interesting. Related in Arch Linux[1]: > Arch Linux is currently in the process of having it 100% reproducible, for the exact definition of reproducible builds and it's benefits take a look at the project website[2]. Arch users can help contribute to Reproducible Build issues by looking at the continuous reproducing environment[3] [1] https://wiki.archlinux.org/index.php/DeveloperWiki:ReproducibleBuilds https://wiki.archlinux.org/index.php/DeveloperWiki:Reproduci... [2] https://reproducible-builds.org/ https://reproducible-builds.org/ [3] https://tests.reproducible-builds.org/archlinux/archlinux.html https://tests.reproducible-builds.org/archlinux/archlinux.ht...

194 points by ericdanielski 7y ago

WRT to this bit: > truly every single app is built from source and therefore F-Droid’s build infrastructure is highly secured, with only Ciaran Gultnieks, who founded the project almost nine years ago, having access to it. What assurances (including legal) are there (besides best intentions) that Ciaran Gultnieks is the only one that has access to the infrastructure that builds F-droid? Also what happens if Ciaran no longer works on the project?

rectang 7y ago
> what happens if Ciaran no longer works on the project? You get a situation like QuadrigaCX when CEO Gerald Cotten passed away and 190 USD in bitcoin became unavailable. https://www.quadrigacxtrustee.com/ https://www.quadrigacxtrustee.com/ Or, to address the problem, something like Shamir's Secret Sharing algorithm could help.
- Avamander 7y ago
  I don't know why the downvotes, the bus factor in this case is 1 and that's horrible.
  - codewiz 7y ago
    Where does HN display the downvote count for a post?
    - ardani 7y ago
      I don't think downvote counts are shown, even to high-karma posters.
    - vinceguidry 7y ago
      You can get a sense for how much a post is being downvoted by the shade of gray the post is displayed with. The closer to white, the more downvotes. HN stopped greying out your own posts, so it's not easy to determine exactly how the behavior is implemented. Personally, I find the greying of a post on even a single downvote to be quite unfortunate and easily abused. I feel a post should only start greying on the second downvote.
      - brewdad 7y ago
        I find it useful and will upvote gray posts that I feel have been downvoted over disagreement rather than truly deserving the downvote. It's probably my most common reason for upvoting.
        akerl_ 7y ago
        It’s potentially worth noting that downvoting over disagreement is considered in-line with the rules: https://news.ycombinator.com/item?id=17996858 https://news.ycombinator.com/item?id=17996858
- MaxBarraclough 7y ago
  $190m. Better source: https://www.theguardian.com/technology/2019/feb/04/quadrigacx-canada-cryptocurrency-exchange-locked-gerald-cotten https://www.theguardian.com/technology/2019/feb/04/quadrigac...
zimbatm 7y ago
Because the builds are reproducible, it means that anyone can re-build the projects and verify that the output is the same, independently. That's the beauty of it, it's the only system that doesn't need a chain of trust. That being said, I don't know enough about the project to say if there are actually people doing the verification work.
- akerl_ 7y ago
  I think it would be more precise to say that reproducible builds rely on asynchronous trust: individual users trust the pre-built packages on the expectation that some users are building from source and comparing against the package results. It’s worth noting here that it’s not sufficient for some users to build from source for their own usage: they have to additionally compare their build results against the version served by the repository, and then they have to publicize if there’s a mismatch. As somebody who builds many things from source, but has never attempted to validate a packaged repo using my results, I’m curious: does anybody here perform this validation?
  - bovine3dom 7y ago
    Mozilla's add-on reviewers do. I know because our build wasn't totally reproducible and they made us make it so.

Hitton 7y ago

The part about Signal is inaccurate. Signal actually offers reproducible builds on their website, they don't want to publish on F-Droid at this time precisely because it wouldn't be signed by their own key, but by F-Droid's which would now just add one more party who would have to be trusted.

upofadown 7y ago
How hard have the Signal people tried? The article specifically says that a reproducible build could be signed by the originator: >If Signal would be built reproducibly, everyone including F-Droid could check whether the app has been built straight from its source code and could then include it in F-Droid’s store
- throwaway2048 7y ago
  Judging by signals history of apathy and hostility towards other open source projects and distributions, my guess would be "they haven't tried at all".
  - bubblethink 7y ago
    This attitude is tiring. F-droid is fine and appreciated, but I really wouldn't want anything critical (say a journalist or whistelblower) to depend on it. If you have to depend on f-droid doing builds, there are no guarantees (it's all best-effort). Firefox and its flavours are routinely outdated. Firefox klar(focus) was outdated for six months because they couldn't build it. Now, let's say that f-droid is poor and run by hobbyists, and upstream ought to do better FOSS builds. Even with that, they don't even have the bandwidth to serve packages. They have one main server which is routinely swamped. It's a struggle to download anything from f-droid reliably. They added mirrors recently, but the main server is still the bottleneck without which the mirrors are useless.
    - chacha2 7y ago
      So a journalist or whistle-blower should use Play Store instead? You can put any repository you want on F-Droid and it'll alert you when there's new updates, that's much better than just having the apk. > Firefox klar(focus) was outdated for six months because they couldn't build it. A build that can't be reproduced is also a security threat.

MYEUHD 7y ago

>the organization behind Signal forbids distributing other binaries than the ones signed by them. Isn't this a GPL violation?

afiori 7y ago
I believe this applies specifically to the Signal brand.
mcny 7y ago
No because GPL does not require you to open your network to anyone. My understanding is you can distribute Signal binaries but you'd have to connect it to your own servers so it is not Signal anymore... It is something based on Signal like whatsapp (which nobody wants)
- thatcat 7y ago
  There was a Noise messaging app on copperhead os that connected to everyone though, I'm not sure how it worked.
- MaxBarraclough 7y ago
  > No because GPL does not require you to open your network to anyone. I don't know what you meant by this, but MYEUHD is correct: you can't release software under GPL and then dictate the terms under which binaries may be distributed, beyond the relevant copyleft restrictions already imposed by the GPL. I'm not convinced that Signal attempt any such prohibition though. There's a discussion over here [0] on this question. Someone rightly points out Stallman's Freedom 2. [0] https://github.com/signalapp/Signal-Android/issues/282#issuecomment-21763403 https://github.com/signalapp/Signal-Android/issues/282#issue...
  - cwyers 7y ago
    Firefox distributes the source via an open source license, but if you want to distribute binaries, you can't use trademarks not covered by the source license without Mozilla's permission.

Avamander 7y ago

They should make reproducible builds mandatory and then sign over apks built by devs. That way they don't have to be trusted specifically and that's how it must be.

aasasd 7y ago

I feel like current understanding of reproducible builds stops short of solving the problem, particularly because I don't quite see users religiously building and comparing the packages, especially hundreds of them. A practical solution, IMO, would be several organizations running and publishing the builds—i.e. several independent F-Droids. Then, a few interested people could rather trivially automatically download the binaries and compare them. If one of the ‘stores’ gets compromised, a mismatch in binaries would indicate that. This implies that versions should be built fully automatically from updated sources, without action on the part of the authors that is specific to the stores. Edit: the idea of distributed builds, mentioned in the article, is similar—but IMO it's still unlikely that people will spend resources on apps that they personally don't use.

brachi 7y ago
but isn't the target users of F-droid developers? E.g. someone who could build things from scratch if they decide to go beyond trusting the signature?
- ardani 7y ago
  Tech generally arrives in the consumer space only after becoming the standard for developers. Literal wizards, they build from source.
- dTal 7y ago
  I don't think that's the case at all. F-Droid is very user-friendly. It supports advanced users, but then all software should.
- aasasd 7y ago
  No. I myself use F-Droid, and my knowledge of Android development consists of editing a line in an XML file in AnkiDroid and rebuilding the app with Gradle like the readme says. And even if the share of nerds is higher among F-Droid users, I still don't think coders often go “wait, this app is open-source, let me build it myself instead of getting a binary.”
Foxboron 7y ago

awinter-py 7y ago

I LOVE the idea of multi-signer reproducible builds F-droid feels incomplete to me -- open source + third party builds are still not enough, we need privacy linting and community code review to have any assurance of what these apps are doing. (But don't mean to dis, F-droid is IMO the best thing about mobile right now)

brachi 7y ago

I think this concept of reproducible builds is very interesting. Related in Arch Linux[1]: > Arch Linux is currently in the process of having it 100% reproducible, for the exact definition of reproducible builds and it's benefits take a look at the project website[2]. Arch users can help contribute to Reproducible Build issues by looking at the continuous reproducing environment[3] [1] https://wiki.archlinux.org/index.php/DeveloperWiki:ReproducibleBuilds https://wiki.archlinux.org/index.php/DeveloperWiki:Reproduci... [2] https://reproducible-builds.org/ https://reproducible-builds.org/ [3] https://tests.reproducible-builds.org/archlinux/archlinux.html https://tests.reproducible-builds.org/archlinux/archlinux.ht...