3 ms·
"it wasn't even a binary pre-built and verified with Homebrew" Most (all?) "formulas" include cryptographic hash checks for any downloaded files: https://githu
by tlrobinson 12y ago
"it wasn't even a binary pre-built and verified with Homebrew"
Most (all?) "formulas" include cryptographic hash checks for any downloaded files: https://github.com/Homebrew/homebrew/blob/master/Library/Formula/mysql.rb https://github.com/Homebrew/homebrew/blob/master/Library/For...
- davexunit 12y agoThis package recipe actually builds from source, which is great! I swear that at one point the mysql package downloaded a pre-built binary from a third party site. Even with a cryptographic hash, I don't trust it, because it could have been built with a tainted compiler. This brings me to an issue that I have not only with homebrew, but with most other package managers: reproducibility. Can I have any confidence that the binaries built on your machine and my machine are the same?
- tlrobinson 12y agoIt actually includes methods for both prebuilt binaries ("bottles" in homebrew terminology) and source. It will use a bottle if one exists for your OS version, but you can force installation from source with "--build-from-source". The problem of bitwise-identical / deterministic builds is difficult when using most legacy tooling, in particular tools that insert timestamps or other non-determinism. Bitcoin and Tor use Gitian https://gitian.org/ https://gitian.org/ and Google just open sourced their tool, Bazel http://bazel.io/ http://bazel.io/