Re:Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reprodu...
by eru on Monday June 21, 2021 @03:39AM
(#27577115)
Reproducible builds still help a lot with security. For example, they let you shift build latency around.
Eg suppose you have a software package X, available both as a binary and in source.
With reproducible builds, you can start distributing the binary to your fleet of computers, while at the same time you are kicking off the build process yourself.
If the result of your own build is the same as the binary you got, you can give the command to start using it. (Otherwise, you quarantine the downloaded binary, and ring some alarm bells.)
Similarly, you can re-build some random sample of packages locally, just to double-check, and report.
If most debian users were to do something like that, any tempering with the debian repositories would be quickly detected.
(Having a few malicious users wouldn't hurt this strategy much, they can only insert noise in the system, but not give you false answers that you trust.)
Eg suppose you have a software package X, available both as a binary and in source.
With reproducible builds, you can start distributing the binary to your fleet of computers, while at the same time you are kicking off the build process yourself.
If the result of your own build is the same as the binary you got, you can give the command to start using it. (Otherwise, you quarantine the downloaded binary, and ring some alarm bells.)
Similarly, you can re-build some random sample of packages locally, just to double-check, and report.
If most debian users were to do something like that, any tempering with the debian repositories would be quickly detected.
(Having a few malicious users wouldn't hurt this strategy much, they can only insert noise in the system, but not give you false answers that you trust.)