5 ms·

How is ghc compiled at all without bootstrapping? Or is there a magic binary in tree that is unreproducible? I have compiled ghc a few times and had no problems

How is ghc compiled at all without bootstrapping? Or is there a magic binary in tree that is unreproducible? I have compiled ghc a few times and had no problems.

jdndndnns 1y ago
And where did you get the haskel compiler to do so? You seem to be missing the point of bootstrapping
- rowanG077 1y ago
  Maybe that is literally why I asked the question, clearly I don't know as I have not spend the time investigating this problem that the commenter has. Asking some kind of gotcha question is not helpful.
lrvick 1y ago
Quite literally all distros today build it by downloading an existing magic binary to compile the latest sources. Even if they claim the package is reproducible, all bets are off on trust if it downloads a prebuilt binary in the build process. It is a prime Trusting Trust attack target. The only other somewhat widely used language I am aware of in this bad of a position is Ada. Every other language I am aware of has a clear bootstrap path.
- icrbow 1y ago
  Ada can't bootstrap? Ironic...
  - lrvick 1y ago
    Yes, and that is a serious security problem because the only way to get trusted PCR values for TPM2 gated secure boot and full disk decryption applications, is with open source full source bootstrapped firmware. Coreboot is the only option, but it has a hard requirement on Ada because that is what they wrote their intel graphics stack in. It is a real mess.
    - utopiah 1y ago
      Interesting, any link I could read to understand a bit more the situation?
      - lrvick 1y ago
        Here is some background on the Haskell situation: https://www.joachim-breitner.de/blog/802-More_thoughts_on_a_bootstrappable_GHC https://www.joachim-breitner.de/blog/802-More_thoughts_on_a_... Ada has had even less progress and I am not aware of any writeups. TL;DR: Ada and Haskell need to have compilers implemented a language that has a full source bootstrap path such as C, Go, or Rust that implement just enough features to compile the official compilers.
        elbear 1y ago
        Just curious, are C, Go and Rust and the only viabile languages for an implementation?
  - leoh 1y ago
    Sounds like an opportunity to rebuild an ADA interpreter
    - lrvick 1y ago
      Yes. Many efforts have started and fizzled out over the years before completion. If you know anyone that takes this on and succeeds I have a 2k cash bounty for them, and we can likely find others.
- rowanG077 1y ago
  I see, yes I most likely used a distro build ghc.
- gf000 1y ago
  Outside some fairly niche projects working on the problem, this is not a priority and most systems have straight binary dependencies.
  - lrvick 1y ago
    The normalized lack of care about supply chain integrity is going pretty poorly, as any read of recent headlines indicates. Stagex has a 100% full source bootstrapping, and reproducibility requirement that at least two maintainers must prove and sign for every package. Stagex is also very heavily used and relied on in high value financial and scientific applications where trusting a binary some internet rando compiled is not even remotely acceptable. Haskell and Ada are locked out of any high security applications until they are bootstrappable.
    - gf000 1y ago
      I'm not saying the status quo is good, but it is nontheless the status quo. Just about every machine on the cloud, mobile devices, etc all have non-source binaries somewhere, and besides some niche projects that actually have an assembly half-C compiler bootstrapping another tiny C compiler bootstrapping a real C compiler, this is not feasible for the vast software ecosystem as of today.
      - jeremyjh 1y ago
        Most mainstream languages have a fairly straightforward bootstrapping process that doesn't rely on a trusted binary. And yes, most distrubutions ignore that, but nonetheless it is possible to use those languages in a high-sec environment if you put the work in. I'm not sure that I agree that GHC can't be bootstrapped though. There is a process for porting to other architectures; its not an automated process and perhaps no one outside the GHC team can actually do it, but if for some insane reason NSA decided they want to use Haskell I'm not sure that they actually can't, if they put a lot of work in and hire GHC committers with high security clearances.
        1y ago

How is ghc compiled at all without bootstrapping? Or is there a magic binary in tree that is unreproducible? I have compiled ghc a few times and had no problems.

jdndndnns 1y ago

And where did you get the haskel compiler to do so? You seem to be missing the point of bootstrapping

rowanG077 1y ago
Maybe that is literally why I asked the question, clearly I don't know as I have not spend the time investigating this problem that the commenter has. Asking some kind of gotcha question is not helpful.

lrvick 1y ago

Quite literally all distros today build it by downloading an existing magic binary to compile the latest sources. Even if they claim the package is reproducible, all bets are off on trust if it downloads a prebuilt binary in the build process. It is a prime Trusting Trust attack target. The only other somewhat widely used language I am aware of in this bad of a position is Ada. Every other language I am aware of has a clear bootstrap path.

icrbow 1y ago
Ada can't bootstrap? Ironic...
- lrvick 1y ago
  Yes, and that is a serious security problem because the only way to get trusted PCR values for TPM2 gated secure boot and full disk decryption applications, is with open source full source bootstrapped firmware. Coreboot is the only option, but it has a hard requirement on Ada because that is what they wrote their intel graphics stack in. It is a real mess.
  - utopiah 1y ago
    Interesting, any link I could read to understand a bit more the situation?
    - lrvick 1y ago
      Here is some background on the Haskell situation: https://www.joachim-breitner.de/blog/802-More_thoughts_on_a_bootstrappable_GHC https://www.joachim-breitner.de/blog/802-More_thoughts_on_a_... Ada has had even less progress and I am not aware of any writeups. TL;DR: Ada and Haskell need to have compilers implemented a language that has a full source bootstrap path such as C, Go, or Rust that implement just enough features to compile the official compilers.
      - elbear 1y ago
        Just curious, are C, Go and Rust and the only viabile languages for an implementation?
- leoh 1y ago
  Sounds like an opportunity to rebuild an ADA interpreter
  - lrvick 1y ago
    Yes. Many efforts have started and fizzled out over the years before completion. If you know anyone that takes this on and succeeds I have a 2k cash bounty for them, and we can likely find others.
rowanG077 1y ago
I see, yes I most likely used a distro build ghc.
gf000 1y ago
Outside some fairly niche projects working on the problem, this is not a priority and most systems have straight binary dependencies.
- lrvick 1y ago
  The normalized lack of care about supply chain integrity is going pretty poorly, as any read of recent headlines indicates. Stagex has a 100% full source bootstrapping, and reproducibility requirement that at least two maintainers must prove and sign for every package. Stagex is also very heavily used and relied on in high value financial and scientific applications where trusting a binary some internet rando compiled is not even remotely acceptable. Haskell and Ada are locked out of any high security applications until they are bootstrappable.
  - gf000 1y ago
    I'm not saying the status quo is good, but it is nontheless the status quo. Just about every machine on the cloud, mobile devices, etc all have non-source binaries somewhere, and besides some niche projects that actually have an assembly half-C compiler bootstrapping another tiny C compiler bootstrapping a real C compiler, this is not feasible for the vast software ecosystem as of today.
    - jeremyjh 1y ago
      Most mainstream languages have a fairly straightforward bootstrapping process that doesn't rely on a trusted binary. And yes, most distrubutions ignore that, but nonetheless it is possible to use those languages in a high-sec environment if you put the work in. I'm not sure that I agree that GHC can't be bootstrapped though. There is a process for porting to other architectures; its not an automated process and perhaps no one outside the GHC team can actually do it, but if for some insane reason NSA decided they want to use Haskell I'm not sure that they actually can't, if they put a lot of work in and hire GHC committers with high security clearances.
      - 1y ago