Reproducible builds: Difference between revisions
m →History: lk GNU Project |
→History: Add Tails, which is an entire OS that is reproducible |
||
| Line 26: | Line 26: | ||
[[F-Droid|F-droid]] uses reproducible builds to provide a guarantee that the distributed APKs use the claimed [[Free software|free source code]].<ref>{{cite web|url=https://f-droid.org/docs/Reproducible_Builds/|title=Reproducible Builds|publisher=F-Droid}}</ref> |
[[F-Droid|F-droid]] uses reproducible builds to provide a guarantee that the distributed APKs use the claimed [[Free software|free source code]].<ref>{{cite web|url=https://f-droid.org/docs/Reproducible_Builds/|title=Reproducible Builds|publisher=F-Droid}}</ref> |
||
The [[Tails]] portable operating system uses reproducible builds and explains to others how to verify their distribution.<ref>{{cite web|url=https://tails.boum.org/contribute/build/reproducible/|title=Verifying a Tails image for reproducibility|publisher=Tails}}</ref> |
|||
==References== |
==References== |
||
Revision as of 21:00, 12 February 2021
Reproducible builds, also known as deterministic compilation, is a process of compiling software which ensures the resulting binary code can be reproduced. Source code compiled using deterministic compilation will always output the same binary.[1][2]
Reproducible builds can act as part of a chain of trust;[1] the source code can be signed, and deterministic compilation can prove that the binary was compiled from trusted source code.
Methods
For the compilation process to be deterministic, the input to the compiler must be the same, regardless of the build environment used. This typically involves normalizing variables that may change, such as order of input files, timestamps, locales, and paths.
Additionally, the compilers must not introduce non-determinism themselves. This sometimes happens when using hash tables with a random hash seed value. It can also happen when using the address of variables because that varies from address space layout randomization (ASLR).
Build systems, such as Bazel and Gitian,[3] can be used to automate deterministic build processes.
History
The GNU Project used reproducible builds in the early 1990s. Changelogs from 1992 indicate the ongoing effort. [4]
One of the older[5] projects to promote reproducible builds is the Bitcoin project with Gitian. Later, in 2013, the Tor (anonymity network) project started using Gitian for their reproducible builds.[6]
In July 2013 on the Debian project started implementing reproducible builds across its entire package archive.[7][8]
By July 2017 more than 90% of the packages in the repository have been proven to build reproducibly.[9]
In November 2018, the Reproducible Builds project joined the Software Freedom Conservancy.[10]
F-droid uses reproducible builds to provide a guarantee that the distributed APKs use the claimed free source code.[11]
The Tails portable operating system uses reproducible builds and explains to others how to verify their distribution.[12]
References
- ^ a b "reproducible-builds.org". reproducible-builds.org. Archived from the original on 20 May 2016. Retrieved 22 August 2016.
Reproducible builds are a set of software development practices which create a verifiable path from human readable source code to the binary code used by computers....build system needs to be made entirely deterministic: transforming a given source must always create the same result.
- ^ Ratliff, Emily (4 April 2016). "Establishing Correspondence Between an Application and its Source Code | SecurityWeek.com". www.securityweek.com. SecurityWeek. Archived from the original on 20 September 2016. Retrieved 22 August 2016.
- ^ "Gitian: a secure software distribution method". gitian.org. Retrieved 2018-01-10.
- ^ "Email describing GNU reproducible builds".
- ^ "LICENSE-file of the Gitian-Project". Retrieved 2019-12-03.
- ^ Deterministic Builds Part Two: Technical Details. October 04, 2013
- ^ "Reproducible Builds talk in Debian".
- ^ "Reproducible Builds history".
- ^ "Linux-Distributionen: Mehr als 90 Prozent der Debian-Pakete reproduzierbar - Golem.de" (in German). 2017-07-24. Retrieved 2018-10-30.
- ^ "Reproducible Builds joins the Software Freedom Conservancy". Retrieved 2018-12-15.
- ^ "Reproducible Builds". F-Droid.
- ^ "Verifying a Tails image for reproducibility". Tails.
External links
 | This computer security article is a stub. You can help Wikipedia by expanding it. |
 | This computer-programming-related article is a stub. You can help Wikipedia by expanding it. |