Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debian must ship reproducible packages

lists.debian.org

Post reply on HN
Print view View original

61–70 of 178 posts

Re: Debian must ship reproducible packages

#61

Post by MomsAVoxell »

murderfs wrote: post #16
iveqy wrote: post #5

Earlier quoted context omitted.

It does not solve all supply chain issues, it do solve some supply chain issues. Not being able to see if the source code shipped is the same as been used for creating the binary is scary

Has there been a single publicly known attack that would have been prevented by this?

Why should it only be valuable if the effects were to be publicly known?

There are plenty of places in industrial computing where reproducible builds have prevented subterfuge within the organizations themselves. Injecting binaries to do inf-/exfiltration is a long-standing industrial espionage activity which is of immense value to all users of the operating system - not just the consumer users.

Re: Debian must ship reproducible packages

#62

Post by MomsAVoxell »

PunchyHamster wrote: post #41
LtWorf wrote: post #30

Earlier quoted context omitted.

Several actually. Pypi is regularly targeted in this way.

Hasn't happened in Debian

“Hasn’t happened” is quite naive. It happens internally - putting unscrupulous code in a company’s distro before torching the place is a surprisingly regular occurrence in places which have long since adopted Debian as a platform host. IT departments around the globe will benefit from this immensely.

Re: Debian must ship reproducible packages

#64

Post by baranul »

ameliaquining wrote: post #26
pixel_popping wrote: post #23

Forbidden You don't have permission to access this resource. Apache Server at lists.debian.org Port 443 :/

I can see it just fine; maybe an overzealous firewall thinks you're a bot? At any rate, the Wayback Machine has it: https://web.archive.org/web/20260510074120/https://lists.deb...

Unfortunately, many of these "protections" don't know what is a bot or a human. Many clueless websites are often just blocking huge swaths of legitimate readers and customers.

Re: Debian must ship reproducible packages

#65

Post by Hendrikto »

charcircuit wrote: post #34

So much time has been wasted on reproducible builds which could have better spent on securing more important parts of Debian. Practically minor changes like a build timestamp being different is not an issue.

It allows verifying that the binaries actually match the source, which is extremely valuable.

Re: Debian must ship reproducible packages

#66

Post by suprjami »

kkfx wrote: post #15

Debian, like any other legacy distro, mush became declarative, because the '80s model of manual deploy and the absurd pain of D/I and Preseed must end.

bootcrew have bootc Containerfiles for Debian, Ubuntu, Arch, and openSUSE:

https://github.com/bootcrew/mono

Re: Debian must ship reproducible packages

#67

Post by tremon »

suprjami wrote: post #55

I am always surprised Debian are leading this and not the commercial vendors. You'd think big organisations paying for RHEL and Ubuntu would be beating down the door for verifiable binaries.

If a competitor can prove that their packages are bit-for-bit identical to what a big organization is shipping, that allows the competitor to benefit from the security assurances of the big org. This is great for software freedom, not so great for wannabe monopolists.

Re: Debian must ship reproducible packages

#68

Post by bluGill »

MomsAVoxell wrote: post #57
PunchyHamster wrote: post #38

Earlier quoted context omitted.

There was no bug or attack on Debian since 2007 that reproducible packages would prevent. "Well worth it" is not correct. And it just ups the the contribution barrier to Debian higher, I already heard a lot of people complaining that contributing to Debian is hard and while in past I defended it by "they need all the checks and bounds to make sure packages play with eachother nicely", this is just step that makes it…

Reproducible builds are applicable not only to respond to ‘attacks’, a subject you seem to be bikeshedding, but also for other reasons too. Anyone having to maintain a code base or a distributed fleet of devices will gain from this decision, immensely, as their operational periods come and go. Reproducible builds are about longevity as much as they are about security . Please don’t make bold claims about ‘no reason a…

I longevity is harmed though. Your certs need to expire in a few years we think that your toolchain will not be downloadable.

Re: Debian must ship reproducible packages

#69

Post by suprjami »

rlpb wrote: post #3
blueflow wrote: post #2

zero improvement on end-user experience. does not solve supply chain issues, debian package will reproducabily contain the malware from upstream.

Debian has had a better "software supply chain" posture than any other player in the ecosystem since before the turn of the century. While we all face the risk of malware from upstream, Debian is the least at risk of being affected by it. See for example the stream of issues from npm et al. None of it has affected Debian.

You do remember the xz-utils backdoor was found in Sid right?

https://en.wikipedia.org/wiki/XZ_Utils_backdoor

Re: Debian must ship reproducible packages

#70

Post by tremon »

otabdeveloper4 wrote: post #35
blueflow wrote: post #2

zero improvement on end-user experience. does not solve supply chain issues, debian package will reproducabily contain the malware from upstream.

> zero improvement on end-user experience The end-user experience is that now you can host your Debian binaries in caches and CDNs without worrying about supply chain hackers. You can verify that file hashes match the ones on Debian's website and sleep much better at night. If you don't trust Debian's website then you can rebuild yourself and check if Debian has been compromised.

You could already do that since Debian cryptographically signs all its package indexes, and the indexes contain the hash of all packages. The additional guarantee that reproducible builds bring is that you can re-build the packages in your own controlled environment and verify that the resulting package is bit-for-bit identical to what Debian offers.
Post reply on HN