3 ms·
> An oft brought-up issue is that the code on crates.io and in Git don’t always match. I don't understand why this is the case. Imo it should be a basic expect
by torginus 6mo ago
> An oft brought-up issue is that the code on crates.io and in Git don’t always match.
I don't understand why this is the case. Imo it should be a basic expectation, that a given package is built from a frozen, dedicated git commit (represented by hash), and a likewise frozen build script. The build should be deterministic, so that the end result should be hashed, and the build script ran by some trusted vendor (maybe github), and the end result hashed.
If there's any doubt about the integrity of a package, the above process can be repeated, and the artifacts checked against a known hash.
This would make builds fully auditable.
- junon 6mo agoBuild scripts often look for system libraries, generate larger artifacts, etc. It's not as black and white as you make it out to be.
- torginus 6mo agoSorry, by build script I mean the script that generates the package, not the actual build. That should run on the build server, not the developer's machine.
- pabs3 6mo agoI think it would be better if the build process ran on both the build server and the devs machine and get the exact same output on both with deterministic/reproducible build processes. https://reproducible-builds.org/ https://reproducible-builds.org/ And it should be possible to build the entire system from scratch without trusting any binaries. https://bootstrappable.org/ https://bootstrappable.org/ https://lwn.net/Articles/983340/ https://lwn.net/Articles/983340/ https://stagex.tools/ https://stagex.tools/
- junon 6mo agoWhich build server? Not everyone has the luxury, and that also means you have to secure a build server now too. For rust, there is no build server. Packages are distributed as code.