Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

Post by taviso » Mon, Jun 21, 2021, 4:35 AM UTC

nixpulvis wrote: post #147

taviso wrote: post #146

Earlier quoted context omitted.

I don't really understand what you're saying. If you're saying "reproducible builds are reproducible", then that is obviously true, but the question is what is the benefit? Some people claim that the benefit is that there will be less incentive to threaten developers with violence, and I'm saying that's nonsense. If you cut through the nonsense, there are some modest claims that are true, but doing reproducible build…

> ... the question is what is the benefit? I don't think I should have to explain this. It has nothing directly to do with violence against developers, that's taking many leaps. It simply gives you what you expect, which is kinda the basis of safety and security.

Post by rswail » Mon, Jun 21, 2021, 4:59 AM UTC

Post by pilif » Mon, Jun 21, 2021, 5:04 AM UTC

staticassertion wrote: post #145

pilif wrote: post #135

Earlier quoted context omitted.

> I can't come up with a single benefit to security from reproducible builds. It is a means to allow to detect a compromised supply chain. If people rebuilding a distro cannot get the same hash as the distro shipping from the distributor, then likely the distributors infrastructure has been compromised

How does this work in practice? The distro is owned, so where are you getting the hash from? I mean, specifically, what does the attacker have control of and how does a repeatable build help me stop them.

Post by staticassertion » Mon, Jun 21, 2021, 5:40 AM UTC

pilif wrote: post #155

staticassertion wrote: post #145

Earlier quoted context omitted.

How does this work in practice? The distro is owned, so where are you getting the hash from? I mean, specifically, what does the attacker have control of and how does a repeatable build help me stop them.

The idea is that multiple independent builders build the same distro. You expect all of them to have the same final hash. This doesn't help against the sources being owned, but it helps about build machines being owned. Accountability for source integrity is in theory provided by the source control system. Accountability for the build machine integrity can be provided by reproducible builds. To answer your specific q…

Post by pjmlp » Mon, Jun 21, 2021, 5:50 AM UTC

xvector wrote: post #127

tbrock wrote: post #69

Earlier quoted context omitted.

Why does building from source help? It’s not like people are reading every line of the source before building it anyway 99.99% of the time.

If the package maintainer's build pipeline is compromised (eg. Solarwinds), you are unlikely to be affected if you build from reviewed source yourself.