In March, the configuration for building openSUSE Factory was changed to be bit-by-bit reproducible (except for the embedded signature). Following this, the ...
  • lemmyreaderEnglish
    15•7 months ago

    Interesting development.

    A recent example is that reproducible builds allow for the creation of proof, simply by rebuilding and comparing the result, that a GCC build whose source was extracted with a compromised xz was not compromised; this process was achieved without needing to reverse engineer how the compromise occurred. Similarly, reproducible builds were reported as being usefully during investigations of the xz compromise.

    • @[email protected]English
      9•7 months ago

      As much as I love openSUSE, and reproducible builds are a core requirement for trusted computing…

      reproducible builds were reported as being useful

      Really buries the lede of the xz attack results

      either both are trojaned, or none

      Edit: It is very useful for the first half - to ensure new packages extracted by a compromised xz weren’t modified during the extraction.

      It’s just that reproducing the build of the tampered xz would still produce a bit-for-bit identical compromised version due to the way it modified the build system