3 ms·

> Reproducible builds are way more important than is currently widely appreciated. Why? How will this help with the problems you're talking about? I can't com

> Reproducible builds are way more important than is currently widely appreciated. Why? How will this help with the problems you're talking about? I can't come up with a single benefit to security from reproducible builds. It seems nice for operational reasons and performance reasons though.

pilif 5y ago
> I can't come up with a single benefit to security from reproducible builds. It is a means to allow to detect a compromised supply chain. If people rebuilding a distro cannot get the same hash as the distro shipping from the distributor, then likely the distributors infrastructure has been compromised
- staticassertion 5y ago
  How does this work in practice? The distro is owned, so where are you getting the hash from? I mean, specifically, what does the attacker have control of and how does a repeatable build help me stop them.
  - pilif 5y ago
    The idea is that multiple independent builders build the same distro. You expect all of them to have the same final hash. This doesn't help against the sources being owned, but it helps about build machines being owned. Accountability for source integrity is in theory provided by the source control system. Accountability for the build machine integrity can be provided by reproducible builds. To answer your specific questions: The attacker has access to the distro's build servers and is packaging and shipping altered binaries that do not correspond to the sources but instead contain added malware. Reproducible builds allow third parties to also build binaries from the same sources and once multiple third parties achieve consensus about the build output, it becomes apparent that the distro's build infrastructure could be compromised.
    - staticassertion 5y ago
      OK so a build machine is owned and we have a sort of consensus for trusted builders, and if there's a consensus mismatch we know something's up. I suppose that's reasonable. Sounds like reproducible builds is a big step towards that, though clearly this requires quite a lot of infrastructure support beyond just that.

pilif 5y ago

> I can't come up with a single benefit to security from reproducible builds. It is a means to allow to detect a compromised supply chain. If people rebuilding a distro cannot get the same hash as the distro shipping from the distributor, then likely the distributors infrastructure has been compromised

staticassertion 5y ago
How does this work in practice? The distro is owned, so where are you getting the hash from? I mean, specifically, what does the attacker have control of and how does a repeatable build help me stop them.
- pilif 5y ago
  The idea is that multiple independent builders build the same distro. You expect all of them to have the same final hash. This doesn't help against the sources being owned, but it helps about build machines being owned. Accountability for source integrity is in theory provided by the source control system. Accountability for the build machine integrity can be provided by reproducible builds. To answer your specific questions: The attacker has access to the distro's build servers and is packaging and shipping altered binaries that do not correspond to the sources but instead contain added malware. Reproducible builds allow third parties to also build binaries from the same sources and once multiple third parties achieve consensus about the build output, it becomes apparent that the distro's build infrastructure could be compromised.
  - staticassertion 5y ago
    OK so a build machine is owned and we have a sort of consensus for trusted builders, and if there's a consensus mismatch we know something's up. I suppose that's reasonable. Sounds like reproducible builds is a big step towards that, though clearly this requires quite a lot of infrastructure support beyond just that.