3 ms·
Because the builds are reproducible, it means that anyone can re-build the projects and verify that the output is the same, independently. That's the beauty of
by zimbatm 7y ago
Because the builds are reproducible, it means that anyone can re-build the projects and verify that the output is the same, independently. That's the beauty of it, it's the only system that doesn't need a chain of trust.
That being said, I don't know enough about the project to say if there are actually people doing the verification work.
- akerl_ 7y agoI think it would be more precise to say that reproducible builds rely on asynchronous trust: individual users trust the pre-built packages on the expectation that some users are building from source and comparing against the package results. It’s worth noting here that it’s not sufficient for some users to build from source for their own usage: they have to additionally compare their build results against the version served by the repository, and then they have to publicize if there’s a mismatch. As somebody who builds many things from source, but has never attempted to validate a packaged repo using my results, I’m curious: does anybody here perform this validation?
- bovine3dom 7y agoMozilla's add-on reviewers do. I know because our build wasn't totally reproducible and they made us make it so.