3 ms·
How would you reproduce the build on systems that are not capable of performing the build due to hardware or practical constraints? If I am obtaining closed-sou
by a_vanderbilt 4y ago
How would you reproduce the build on systems that are not capable of performing the build due to hardware or practical constraints? If I am obtaining closed-source packages, how do I reproduce those builds? The benefit of signing is adjacent, but not the same as the need to confirm the output of the build process.
- bombolo 4y agoIf you're getting closed source, certainly debian has nothing to do with it and you have to take issue with your distributor?
- a_vanderbilt 4y agoDebian defines the package format and fosters the culture around that format. Third-parties who wish to distribute software via Debian packages have to use the standard that Debian has decided upon. I am taking up the issue with Debian, as the distributor of the Debian package format.
- bombolo 4y agoOk. But what kind of magic signature do you want to know that the code you're running matches the source, if the software is closed source and you have no access to the source? Your requirement makes no sense. Are you a product manager? :D
- a_vanderbilt 4y agoRe-read my initial reply to the thread. It is stated.
- bombolo 4y agogpg can be used to sign a single file, if for any reason you download a single .deb instead of using a repository. If your supplier doesn't sign them… take it with them?