4 ms·
"TrueCrypt is a project that doesn't provide deterministic builds." Why? What is the benefit of doing so when everyone wants a deterministic build?
by yeukhon 13y ago
"TrueCrypt is a project that doesn't provide deterministic builds."
Why? What is the benefit of doing so when everyone wants a deterministic build?
- dublinben 13y agoThey also use a unique license that is incompatible with most other open source projects. They seem to have strong reasons for doing things the way they do, and aren't fond of explaining them.
- im3w1l 13y ago>and aren't fond of explaining them. Who tried to poke them how, and what happened?
- aroch 13y agoDeterministic builds are hard...really hard. The combined power of the Debian community has trouble getting deterministic builds, as does the Tor project.
- yeukhon 13y agoOh! I thought that was the norm. Author made it sounded like TrueCrypt doesn't and others do the way he said it.
- sliverstorm 13y agoWhen I think of deterministic builds, I think of the ROMs on the old GameBoy. Apparently some of the ROMs had whatever empty space was left in the fixed-size image padded with random data pulled straight out of the build host's memory. As if consistent tool versions weren't already enough of a challenge!
- x3c 13y agoJust in case someone (like me) is not familiar with the concept of deterministic builds, this is a good read: https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise https://blog.torproject.org/blog/deterministic-builds-part-o... Synopsis: "deterministic builds" -- packages which are byte-for-byte identical no matter who actually builds them, or what hardware they use.
- antocv 13y agoIsnt nix and guix a kind of solution that the deterministic build problem? They produce builds with hashes of the source and all dependencies and tools used, or so I believe after skimming their manuals.
- edwintorok 13y agoThey're not really a solution if the official binaries are compiled using VC, and you want to compare to that.
- deleted 13y ago[deleted]
- gngeal 13y agoDeterministic builds are hard...really hard. I'd have thought that deterministic builds are really simple unless your toolkit ecosystem is FUBAR. After all, a compiler is a simple function from input to output (unless the FUBAR ecosystem syndrome arises, as I said).
- UnFleshedOne 13y agoHere is a not-in-depth look at what's involved in trying to generate byte-for byte binaries on msvc: http://stackoverflow.com/questions/1180852/deterministic-builds-under-windows http://stackoverflow.com/questions/1180852/deterministic-bui... In short, if you ignore certain things when comparing binaries and make sure you build things on absolute path of the same length(!), you can tell binaries are functionally equivalent.
- PeterisP 13y agoWell, the parent poster would say that if binaries depend on the path length of build location, then that's evidence of a FUBAR toolchain :)
- deleted 13y ago[deleted]
- fidz 13y agoI don't understand, what is the problem if we have different compiled binary?
- RexRollman 13y agoFrom my understanding, if you can achieve deterministic builds, it makes it easier to detect tampering.
- Lagged2Death 13y agoI wish the term "reproducible builds" were the more popular one. I think that's more accurate.
- 3825 13y agoFor what it is worth, that is what Debian[0] seems to call it as well. [0] https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds