Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debian must ship reproducible packages

lists.debian.org

Post reply on HN
Print view View original

21–30 of 178 posts

Re: Debian must ship reproducible packages

#21

Post by ownagefool »

mschuster91 wrote: post #7
blueflow wrote: post #2

zero improvement on end-user experience. does not solve supply chain issues, debian package will reproducabily contain the malware from upstream.

That's not what reproducible builds aim to prevent, and no one claims that. When upstream pushes bad code, that's on upstream. The thing reproducible builds aim to prevent is Debian or individual developers and system administrators with access rights to binary uploads and signing keys to get forced to sign and upload binary packages by attackers - be these governments (with or without court orders) or criminal organ…

Reproducible builds shows that, within a specific configuration, the code produced the binary, regardless of who signed or published it.

Indeed, this could mitigate an attacker replacing the binary with something that's not produced from the code, but it does not mitigate the tool chain or code itself containing the exploit, creating a malicious binary.

Re: Debian must ship reproducible packages

#24

Post by perlgeek »

https://wiki.debian.org/ReproducibleBuilds has some more infos; some is outdated, but it also has a chart showing how many packages are built in the CI, and how many of those are reproducible builds.

(Orange = FTBR = "failed to build reproducibly")

I'm not good at reading numbers from charts, but I'd guess it's a few percent (4-5ish?).

Re: Debian must ship reproducible packages

#25

Post by gjvc »

stingraycharles wrote: post #11
shevy-java wrote: post #8

A small step for debian, giant leap for mankind.

As someone who recently spent a lot of time on making a large C++ program entirely reproducible on 4 different OS’es, one cannot understate just how many tiny details matter here.

"overstate"

Re: Debian must ship reproducible packages

#26

Post by ameliaquining »

pixel_popping wrote: post #23

Forbidden You don't have permission to access this resource. Apache Server at lists.debian.org Port 443 :/

I can see it just fine; maybe an overzealous firewall thinks you're a bot? At any rate, the Wayback Machine has it: https://web.archive.org/web/20260510074120/https://lists.deb...

Re: Debian must ship reproducible packages

#28

Post by LtWorf »

miohtama wrote: post #13
quantummagic wrote: post #6

Earlier quoted context omitted.

> zero improvement on end-user experience. Maybe not by itself, but it does allow for the ecosystem to be audited, in a way that ultimately benefits the end-user. It really is an important part of a healthy supply chain.

[flagged]

NK isn't the hostile superpower I'm most concerned about.

Re: Debian must ship reproducible packages

#30

Post by LtWorf »

murderfs wrote: post #16
iveqy wrote: post #5

Earlier quoted context omitted.

It does not solve all supply chain issues, it do solve some supply chain issues. Not being able to see if the source code shipped is the same as been used for creating the binary is scary

Has there been a single publicly known attack that would have been prevented by this?

Several actually. Pypi is regularly targeted in this way.
Post reply on HN