3 ms·
Is it technically pointless if you view it as a check on your own build, rather than a check on the work of others? You are obviously familiar with Bazel/Blaze
by sayrer 5y ago
Is it technically pointless if you view it as a check on your own build, rather than a check on the work of others?
You are obviously familiar with Bazel/Blaze etc. Wouldn't reproducibility be necessary for those systems to work well most of the time? I can think of exceptions (like PGO), but it seems useful to produce at least some binaries this way. Also covered in this: https://security.googleblog.com/2021/06/introducing-slsa-end-to-end-framework.html https://security.googleblog.com/2021/06/introducing-slsa-end...
- taviso 5y ago> Is it technically pointless if you view it as a check on your own build, rather than a check on the work of others? That depends, I think it's difficult and mostly still pointless. I wrote about this a bit in the blog post I linked to. It's a big trade off, for questionable benefit. > Wouldn't reproducibility be necessary for those systems to work well most of the time? Yes, there are definitely some good non-security reasons to want deterministic builds. My gripe is only with the security arguments, like claims it can reduce threats of violence against developers (!?!).