Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debian must ship reproducible packages

lists.debian.org

Post reply on HN
Print view View original

111–120 of 178 posts

Re: Debian must ship reproducible packages

#111

Post by Dwedit »

suprjami wrote: post #69
rlpb wrote: post #3

Earlier quoted context omitted.

Debian has had a better "software supply chain" posture than any other player in the ecosystem since before the turn of the century. While we all face the risk of malware from upstream, Debian is the least at risk of being affected by it. See for example the stream of issues from npm et al. None of it has affected Debian.

You do remember the xz-utils backdoor was found in Sid right? https://en.wikipedia.org/wiki/XZ_Utils_backdoor

It would have been found in a whole lot more places if it hadn't been for that meddling Microsoft employee.

Re: Debian must ship reproducible packages

#112

Post by Atotalnoob »

ckastner wrote: post #100
PunchyHamster wrote: post #38

Earlier quoted context omitted.

There was no bug or attack on Debian since 2007 that reproducible packages would prevent. "Well worth it" is not correct. And it just ups the the contribution barrier to Debian higher, I already heard a lot of people complaining that contributing to Debian is hard and while in past I defended it by "they need all the checks and bounds to make sure packages play with eachother nicely", this is just step that makes it…

> There was no bug or attack on Debian since 2007 that reproducible packages would prevent. I'm reading this as a suggestion that the reproducible builds effort was an ineffective deterrent. However, note that your observation could also be explained by the opposite: the reproducible builds effort was an effective deterrent, so nobody bothered with attempts. > And it just ups the the contribution barrier to Debian hi…

That’s a big logical fallacy, I’m not sure if that’s what you want to go with

Re: Debian must ship reproducible packages

#113

Post by PunchyHamster »

savolai wrote: post #49
PunchyHamster wrote: post #38

Earlier quoted context omitted.

There was no bug or attack on Debian since 2007 that reproducible packages would prevent. "Well worth it" is not correct. And it just ups the the contribution barrier to Debian higher, I already heard a lot of people complaining that contributing to Debian is hard and while in past I defended it by "they need all the checks and bounds to make sure packages play with eachother nicely", this is just step that makes it…

” If you are wondering why we are doing this at all, then hopefully the Reproducible Builds website will explain why this is useful.” https://reproducible-builds.org/ Could you perhaps respond to the argumentation here?

I know why they are useful. I am arguing they are waste of time for effort involved.

Forcing devs to use hardware keys to sign commits/CI requests would be actual security improvement, thwarting many supply chain attacks that only worked coz the attacker got to developer credentials. Hardware keys at least have option to make some operations require physically pressing the key so there is chance developer will notice.

But thanks to reproducible builds, at least someone can... validate that the binary code of vulnerable package can be reproduced. Very fucking useful.

I am not saying it is useless. I am saying it is one of highest hanging fruits on security tree.

Re: Debian must ship reproducible packages

#114

Post by PunchyHamster »

fsflover wrote: post #97
dvogel wrote: post #83

Earlier quoted context omitted.

(Not OP, but...) I still fail to see the current value in confirming that a reproducing builder also included the same compromised dependency that I did when I built it. I understand that reproducible builds are guarding against dynamic attacks within build infrastructure. However I just don't see those happening. Compromised source dependencies are a 100x more common problem.

https://en.wikipedia.org/wiki/XZ_Utils_backdoor

that's example of attack reproducible packages do not protect from, why you are linking it ?

Re: Debian must ship reproducible packages

#115

Post by PunchyHamster »

sgc wrote: post #81
azkalam wrote: post #50

Earlier quoted context omitted.

Reproducible builds reduce the need for trusted parties. Have many organizations produce the binaries independently and post the arifacts. Once n of m parties agree on the arifact hash, take that as the trusted build. If every party reaches a different hash then we cannot build consensus.

To move away from organizational dependence, there should be an installable project for debian where I can dedicate some configurable small percentage of my compute when idle to reproducibly building debian components to make a robust verification system, starting with the most critical code. Obviously, it would be a ton of work to make such a system resistant to gaming by malicious actors (see GNU Guix for useful ef…

I think that project is called Ubuntu.

Re: Debian must ship reproducible packages

#116

Post by goodpoint »

jcranmer wrote: post #109
benregenspan wrote: post #88

Earlier quoted context omitted.

Is the "Jia Tan" XZ Utils compromise not a good example? That relied on code snuck into a release that was not in source. (It was caught before being promoted into a stable Debian release, yes, but this sort of relied on a happy accident, too close for comfort)

The xz utils compromise is a very good example... of why reproducible packages doesn't actually solve anything security-wise! The backdoor relied first on a difference between building a package in a packaging environment versus building the package on your own. And also, it relied on the very common practice of checking in unreviewable artifacts into the source tree (e.g., the configure script, malicious binary test…

No, reproducible builds make such backdoors more difficult to sneak in together with other checks.

Re: Debian must ship reproducible packages

#117

Post by PunchyHamster »

ckastner wrote: post #100
PunchyHamster wrote: post #38

Earlier quoted context omitted.

There was no bug or attack on Debian since 2007 that reproducible packages would prevent. "Well worth it" is not correct. And it just ups the the contribution barrier to Debian higher, I already heard a lot of people complaining that contributing to Debian is hard and while in past I defended it by "they need all the checks and bounds to make sure packages play with eachother nicely", this is just step that makes it…

> There was no bug or attack on Debian since 2007 that reproducible packages would prevent. I'm reading this as a suggestion that the reproducible builds effort was an ineffective deterrent. However, note that your observation could also be explained by the opposite: the reproducible builds effort was an effective deterrent, so nobody bothered with attempts. > And it just ups the the contribution barrier to Debian hi…

> However, note that your observation could also be explained by the opposite: the reproducible builds effort was an effective deterrent, so nobody bothered with attempts.

There was no attack that reproducible builds would help protect from before 2007 either.

> Until yesterday, the package just got flagged in the tracker, and you could either ignore it, or fix it yourself, or the kind people behind the reproducible builds effort supplied a patch themselves.

> Now, you can no longer ignore it. But fixes are often trivial. Use a (stable) timestamp provided by the build, seed RNGs with some constant (instead of eg: time), etc.

that's the entirety of the problem. App developers don't want to be package experts or build experts.

> These are best practices anyway.

They are not. They are best practices if you want reproducible builds. They are entirely useless waste of time if you don't care.

Re: Debian must ship reproducible packages

#118

Post by dezgeg »

micw wrote: post #45

I wonder why this is a thing nowadays. I use yocto for embedded devices and it was almost a no-brainer to implement reproducible builds. I can also easily enable Debian package management, so everything is already available.

Did you actively verify that your builds were bit-reproducible?

Re: Debian must ship reproducible packages

#119

Post by fsflover »

PunchyHamster wrote: post #114
fsflover wrote: post #97

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/XZ_Utils_backdoor

that's example of attack reproducible packages do not protect from, why you are linking it ?

A distro automatically verifying that installed packages are reproducible would protect the user?

Re: Debian must ship reproducible packages

#120

Post by yjftsjthsd-h »

PunchyHamster wrote: post #117
ckastner wrote: post #100

Earlier quoted context omitted.

> There was no bug or attack on Debian since 2007 that reproducible packages would prevent. I'm reading this as a suggestion that the reproducible builds effort was an ineffective deterrent. However, note that your observation could also be explained by the opposite: the reproducible builds effort was an effective deterrent, so nobody bothered with attempts. > And it just ups the the contribution barrier to Debian hi…

> However, note that your observation could also be explained by the opposite: the reproducible builds effort was an effective deterrent, so nobody bothered with attempts. There was no attack that reproducible builds would help protect from before 2007 either. > Until yesterday, the package just got flagged in the tracker, and you could either ignore it, or fix it yourself, or the kind people behind the reproducible…

> that's the entirety of the problem. App developers don't want to be package experts or build experts.

App developers and Debian package maintainers are already separate groups.

Post reply on HN