Post #2096836

2024-03-29 22:41 UTC

@glyph @AndresFreundTec That is true. Binary artifacts have no business existing in Free Software (or near-binary considering how auditable pre-generated config scripts end-up being). The way it was compromised in this case is almost certain to have happened before and reminds me of the SourceForge malware debacle (so arguably that's another famous example of it happening before). I"m not sure if many other projects do like Guix and record the checksum of the whole repository so as to ensure reproducibility purely from source.

Replies (3)

@glyph@mastodon.social 2024-03-30 00:25

@lispi314 @AndresFreundTec In general this is reasonable, but this there are some clear exceptions for test vectors in cryptographic libraries and compression libraries (which this was).

Open ##2096837
@kirschwipfel@nerdculture.de 2024-03-30 08:31

> I"m not sure if many other projects do like Guix and record the checksum of the whole repository so as to ensure reproducibility purely from source. If the packager chooses to use the official tarball as "the source", validating the checksum would not have helped. :-( Also whether it's always possible to run running autoreconf depends on the content of the tarball. Which brings me to the (preliminary) conclusion that we'd better use repos as source of trust @lispi314 @AndresFreundTec @glyph

Open ##2096839
@mem@mastodon.cr 2024-04-01 20:27

@lispi314 @AndresFreundTec @glyph we have been using docker images for what? 10+ years now, and "everyone" seems OK with the fact that the vast majority of them are not reproducible because the corresponding dockerfile is not generally available.

Open ##2096841