5 ms·

I don't know this area, but it seems to me it might be a boon to security? So that you can tell if components have been tampered with?

by tomcam 2y ago

bobmcnamara 2y ago
Bingo. We caught a virus tampering with one of our code gens this way.
dwheeler 2y ago
Yes! The attack on SolarWinds Orion was an attack on its build process. A verified reproducible build would have detected the subversion, because the builds would not have matched (unless the attackers managed to detect and break into all the build processes).
- oneshtein 2y ago
  Exact same binary can be hacked in exact same way on all platforms.
  - yjftsjthsd-h 2y ago
    What?
  - tomcam 2y ago
    If I understand correctly that would require releasing the publisher’s private key, though，correct?
    - dwheeler 1y ago
      Only if you try to reproduce the signature. Usually the signature is stored separately. That way, the reproduced work's signature applies to it as well.
  - dwheeler 1y ago
    That would requiring breaking each of the separate build processes, which is very unlikely. This doesn't counter subverted source code, that's not what reproduciblrle builds are for.
drewcoo 2y ago
for related, see Ken Thompson: http://genius.cat-v.org/ken-thompson/texts/trusting-trust/ http://genius.cat-v.org/ken-thompson/texts/trusting-trust/
LinuxBender 2y ago
That's already been a thing in all the Redhat variants. RPM/DNF have checksums of the installed binaries and there is GPG signing of packages and repositories. The only part of that ecosystem I've always had a gripe with is putting the GPG public keys in the mirrors. People should have to grab those from non mirrors or any low skilled attacker can just replace the keys and sign everything again. It would be caught but not right away. Changes can also be caught using bolt on tools like Tripwire, OSSEC and it's alternatives or even home grown tools that build signed manifests of approved packages usually for production approval.

I don't know this area, but it seems to me it might be a boon to security? So that you can tell if components have been tampered with?

by tomcam 2y ago

I don't know this area, but it seems to me it might be a boon to security? So that you can tell if components have been tampered with?

bobmcnamara 2y ago

Bingo. We caught a virus tampering with one of our code gens this way.

dwheeler 2y ago

Yes! The attack on SolarWinds Orion was an attack on its build process. A verified reproducible build would have detected the subversion, because the builds would not have matched (unless the attackers managed to detect and break into all the build processes).

oneshtein 2y ago
Exact same binary can be hacked in exact same way on all platforms.
- yjftsjthsd-h 2y ago
  What?
- tomcam 2y ago
  If I understand correctly that would require releasing the publisher’s private key, though，correct?
  - dwheeler 1y ago
    Only if you try to reproduce the signature. Usually the signature is stored separately. That way, the reproduced work's signature applies to it as well.
- dwheeler 1y ago
  That would requiring breaking each of the separate build processes, which is very unlikely. This doesn't counter subverted source code, that's not what reproduciblrle builds are for.

drewcoo 2y ago

for related, see Ken Thompson: http://genius.cat-v.org/ken-thompson/texts/trusting-trust/ http://genius.cat-v.org/ken-thompson/texts/trusting-trust/

LinuxBender 2y ago

That's already been a thing in all the Redhat variants. RPM/DNF have checksums of the installed binaries and there is GPG signing of packages and repositories. The only part of that ecosystem I've always had a gripe with is putting the GPG public keys in the mirrors. People should have to grab those from non mirrors or any low skilled attacker can just replace the keys and sign everything again. It would be caught but not right away. Changes can also be caught using bolt on tools like Tripwire, OSSEC and it's alternatives or even home grown tools that build signed manifests of approved packages usually for production approval.