5 ms·

IMO you need an immutable appliance-like OS that is deterministic and full source bootstrapped to do reproductions with minimized trusting-trust attack risk. W

by lrvick 1y ago

IMO you need an immutable appliance-like OS that is deterministic and full source bootstrapped to do reproductions with minimized trusting-trust attack risk. We built ReprOS to solve this problem: https://codeberg.org/stagex/repros https://codeberg.org/stagex/repros "Git push" to it and it will do a build in a throw-away VM then have the host sign the artifact results and push signatures to the same or a different repo.

0cf8612b2e1e 1y ago
This is a great idea. Less boil the ocean than getting everything into Nix. Are any notable projects using this?
- lrvick 1y ago
  Not yet, although Turnkey and Stagex are in the process of integrating it for automated reproductions as part of their CI for everything. It will no doubt mature a fair bit more through this process
tomcam 1y ago
Love this project; thanks for letting us know about it. I have been voted "Least likely to succeed in Web Hosting Security" by HN for 13 years in a row, so apologies if this is irrelevant. But being able to know precisely what software you're running would be a great way to run a web server, no? Or is it not efficient enough running in a container or what?
- lrvick 1y ago
  That is why we made StageX, which allows you to generate bootable web server images or containers bit for bit identical every time so prod is predictable and accountable. https://stagex.tools https://stagex.tools
- andrecarini 1y ago
  > I have been voted "Least likely to succeed in Web Hosting Security" by HN for 13 years in a row, Curious, what is this about? Care to share the context?
  - lrvick 1y ago
    That was clearly just a joke meant to indicate they are not a security professional.
conradev 1y ago
Or Debian or NixOS? Both of which are pretty reproducible: https://reproducible-builds.org/success-stories/ https://reproducible-builds.org/success-stories/ You just need a read-only system partition, like macOS or NixOS or Silverblue.
- lrvick 1y ago
  MacOS is closed source centralized trust so it is not even trying to have accountability. If you add in Homebrew you -also- add trust in hundreds of unvetted internet randos pushing and merging unsigned commits without strict review requirements. Silverblue and NixOS are not fully reproducible, and rely on blind maintainer trust to merge anything they want, then shifts to a centralized build/signing trust model for all packages (single points of failure) Debian has inflated reproducibility stats as it allows bootstrapping packages from binary blobs exposing it to trusting trust attacks, and overall relies on a distributed trust model where different maintainers maintain and sign different packages (many points of failure) Stagex, which is what ReprOS is built with, relies on a decentralized trust model with 100% full-source-bootstrapped, deterministic, multi-party-signed commits, with multi-party-signed builds, (no single computer or human is trusted). The former options are highly complex desktop focused operating systems that are fast and loose with supply chain security in order to maximize contributions and package variety. Stagex by contrast is -not- a desktop distribution and cranks supply chain security all the way up focusing primarily on those few packages needed for mission critical build, administrative, and server use cases. ReprOS by extension you can build from hex0 all the way up to compilers and a final .iso bit for bit identical every time, so admins can form confidence they are running unmodified upstream source code without any chance of tampering by a compromised maintainer.
  - conradev 1y ago
    That is very cool and makes sense! I can see myself using this for sure. Put that in the README! :P
    - lrvick 1y ago
      There is a comparison section in the stagex README: https://codeberg.org/stagex/stagex https://codeberg.org/stagex/stagex Let us know if you can think of any ways we could communicate how we differ better!
chubot 1y ago
Hm that looks pretty nice and useful But I'd also say another way to do it is to build / cross compile on two totally different machines, say Linux and OS X, or Linux and FreeBSD, or even a modern Debian and some Linux VM from 2005 If the results are exactly the same, then I think it can be trusted I guess that's like Diverse Double-Compiling, but extended to the whole machine: https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
- lrvick 1y ago
  That is exactly what we do in StageX on which ReprOS is based. Given all builds start from hex0 you can build from an Arch Linux host and I can build from a Debian host and we are still guaranteed identical results every time. Every altered package is reproduced bit-for-bit identically by multiple different maintainers and signed every release. Our entire distro and release process is built around addressing trusting trust attacks which is why we must be 100% deterministic or we cannot ship a release.
  - chubot 1y ago
    Ah OK that's interesting ... so I guess ReprOS saves other projects the effort of doing that themselves! I am honestly not sure how much effort it would be; I was thinking about doing it / verifying it for https://oils.pub/ https://oils.pub/ , which has a large build process But it may save time to use ReprOS. I'll look at it more - it sounds interesting!

by lrvick 1y ago

0cf8612b2e1e 1y ago

This is a great idea. Less boil the ocean than getting everything into Nix. Are any notable projects using this?

lrvick 1y ago
Not yet, although Turnkey and Stagex are in the process of integrating it for automated reproductions as part of their CI for everything. It will no doubt mature a fair bit more through this process

tomcam 1y ago

Love this project; thanks for letting us know about it. I have been voted "Least likely to succeed in Web Hosting Security" by HN for 13 years in a row, so apologies if this is irrelevant. But being able to know precisely what software you're running would be a great way to run a web server, no? Or is it not efficient enough running in a container or what?

lrvick 1y ago
That is why we made StageX, which allows you to generate bootable web server images or containers bit for bit identical every time so prod is predictable and accountable. https://stagex.tools https://stagex.tools
andrecarini 1y ago
> I have been voted "Least likely to succeed in Web Hosting Security" by HN for 13 years in a row, Curious, what is this about? Care to share the context?
- lrvick 1y ago
  That was clearly just a joke meant to indicate they are not a security professional.

conradev 1y ago

Or Debian or NixOS? Both of which are pretty reproducible: https://reproducible-builds.org/success-stories/ https://reproducible-builds.org/success-stories/ You just need a read-only system partition, like macOS or NixOS or Silverblue.

lrvick 1y ago
MacOS is closed source centralized trust so it is not even trying to have accountability. If you add in Homebrew you -also- add trust in hundreds of unvetted internet randos pushing and merging unsigned commits without strict review requirements. Silverblue and NixOS are not fully reproducible, and rely on blind maintainer trust to merge anything they want, then shifts to a centralized build/signing trust model for all packages (single points of failure) Debian has inflated reproducibility stats as it allows bootstrapping packages from binary blobs exposing it to trusting trust attacks, and overall relies on a distributed trust model where different maintainers maintain and sign different packages (many points of failure) Stagex, which is what ReprOS is built with, relies on a decentralized trust model with 100% full-source-bootstrapped, deterministic, multi-party-signed commits, with multi-party-signed builds, (no single computer or human is trusted). The former options are highly complex desktop focused operating systems that are fast and loose with supply chain security in order to maximize contributions and package variety. Stagex by contrast is -not- a desktop distribution and cranks supply chain security all the way up focusing primarily on those few packages needed for mission critical build, administrative, and server use cases. ReprOS by extension you can build from hex0 all the way up to compilers and a final .iso bit for bit identical every time, so admins can form confidence they are running unmodified upstream source code without any chance of tampering by a compromised maintainer.
- conradev 1y ago
  That is very cool and makes sense! I can see myself using this for sure. Put that in the README! :P
  - lrvick 1y ago
    There is a comparison section in the stagex README: https://codeberg.org/stagex/stagex https://codeberg.org/stagex/stagex Let us know if you can think of any ways we could communicate how we differ better!

chubot 1y ago

Hm that looks pretty nice and useful But I'd also say another way to do it is to build / cross compile on two totally different machines, say Linux and OS X, or Linux and FreeBSD, or even a modern Debian and some Linux VM from 2005 If the results are exactly the same, then I think it can be trusted I guess that's like Diverse Double-Compiling, but extended to the whole machine: https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/

lrvick 1y ago
That is exactly what we do in StageX on which ReprOS is based. Given all builds start from hex0 you can build from an Arch Linux host and I can build from a Debian host and we are still guaranteed identical results every time. Every altered package is reproduced bit-for-bit identically by multiple different maintainers and signed every release. Our entire distro and release process is built around addressing trusting trust attacks which is why we must be 100% deterministic or we cannot ship a release.
- chubot 1y ago
  Ah OK that's interesting ... so I guess ReprOS saves other projects the effort of doing that themselves! I am honestly not sure how much effort it would be; I was thinking about doing it / verifying it for https://oils.pub/ https://oils.pub/ , which has a large build process But it may save time to use ReprOS. I'll look at it more - it sounds interesting!