3 ms·
Do you know an example for a security property that a reproducible build would be able to guarantee, and where pinning a dependency against a version identifier
by Hackbraten 3y ago
Do you know an example for a security property that a reproducible build would be able to guarantee, and where pinning a dependency against a version identifier plus digest of the release tarball wouldn't accomplish the same thing?
- dartos 3y agoI think pinning a dependency against a version identifier and a digest of a tarball is a great way to ensure reproducibility. You’re controlling which dependency you’re using very specifically. Reproducibility like this protects against supply chain attacks. This may be a bit contrived, but It could prevent a malicious package maintainer from releasing a modified version of OpenSSL that you depend on without you noticing that change in your dependencies.