25 ms·
Yes, making sure build timestamps are reproducible isn't a security win. What is a win is that two independent parties can run the same build, and get the same
by farfatched 5mo ago
Yes, making sure build timestamps are reproducible isn't a security win.
What is a win is that two independent parties can run the same build, and get the same binaries.
This is important because it removes trust from builders: anyone can verify their output.
It just so happens that unimportant things like build versions impede that.
- charcircuit 5mo agoAnyone can verify the actual code in the binary matches even if some bytes within the binary file itself are different. The verification routine doesn't have to be a basic bit for bit equality test.
- farfatched 5mo agoFor sure. This has been the status quo in Debian for a while now. You can build, and use diffoscope to audit the differences. It's a stronger security property to have bit-for-bit reproducibilty, and it looks like Debian are ready to commit to it.
- charcircuit 5mo agoYou are just restating the point of the thread and not addressing the low return on investment doing this is.
- farfatched 5mo agoFair point. I had figured the cost would decrease in time as deterministic builds became the norm (i.e. build tools stop including build timestamps). I agree that it might not have positive POI. Bit tricky for me to judge.