5 ms·
Deterministic builds are hard...really hard. The combined power of the Debian community has trouble getting deterministic builds, as does the Tor project.
by aroch 13y ago
Deterministic builds are hard...really hard. The combined power of the Debian community has trouble getting deterministic builds, as does the Tor project.
- yeukhon 13y agoOh! I thought that was the norm. Author made it sounded like TrueCrypt doesn't and others do the way he said it.
- sliverstorm 13y agoWhen I think of deterministic builds, I think of the ROMs on the old GameBoy. Apparently some of the ROMs had whatever empty space was left in the fixed-size image padded with random data pulled straight out of the build host's memory. As if consistent tool versions weren't already enough of a challenge!
- x3c 13y agoJust in case someone (like me) is not familiar with the concept of deterministic builds, this is a good read: https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise https://blog.torproject.org/blog/deterministic-builds-part-o... Synopsis: "deterministic builds" -- packages which are byte-for-byte identical no matter who actually builds them, or what hardware they use.
- antocv 13y agoIsnt nix and guix a kind of solution that the deterministic build problem? They produce builds with hashes of the source and all dependencies and tools used, or so I believe after skimming their manuals.
- edwintorok 13y agoThey're not really a solution if the official binaries are compiled using VC, and you want to compare to that.
- deleted 13y ago[deleted]
- gngeal 13y agoDeterministic builds are hard...really hard. I'd have thought that deterministic builds are really simple unless your toolkit ecosystem is FUBAR. After all, a compiler is a simple function from input to output (unless the FUBAR ecosystem syndrome arises, as I said).
- UnFleshedOne 13y agoHere is a not-in-depth look at what's involved in trying to generate byte-for byte binaries on msvc: http://stackoverflow.com/questions/1180852/deterministic-builds-under-windows http://stackoverflow.com/questions/1180852/deterministic-bui... In short, if you ignore certain things when comparing binaries and make sure you build things on absolute path of the same length(!), you can tell binaries are functionally equivalent.
- PeterisP 13y agoWell, the parent poster would say that if binaries depend on the path length of build location, then that's evidence of a FUBAR toolchain :)
- deleted 13y ago[deleted]
- fidz 13y agoI don't understand, what is the problem if we have different compiled binary?
- RexRollman 13y agoFrom my understanding, if you can achieve deterministic builds, it makes it easier to detect tampering.