3 ms·

Can you explain what reproducible mean in this context? Does that mean that you can recompile everything from "scratch" or does it have a deeper meaning?

• jraph 11mo ago
  Reproducible builds ensure that you can build the same binaries with the same source code. Nothing like the current date for instance gets in the way of getting a different build. This allows independent people to check that provided binaries don't contain malicious stuff for instance. Ultimately, it lets you download binaries instead of rebuilding everything yourself locally if the binaries have been independently reproduced. You might be interested in checking: https://reproducible-builds.org/ https://reproducible-builds.org/ https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds
  • irundebian 11mo ago
    The provided binaries may still contain malicious code but it guarantees that no malicious code has been inserted in between the build process of the published code. So if your binaries contain malicious code, you can be sure that all other users of the software version are affected, too.
    • jraph 11mo ago
      Indeed, thanks for the precision!
    • tuananh 11mo ago
      does anyone practice dual build pipeline? eg: 1 by your devops team and another one by your security team and compare binaries hash later. To verify everything is reproducible. is it a common practice?
      • indolering 11mo ago
        It is not common outside of security inclined communities like cryptocurrencies. It should be and we are slowly moving there.