Post #2176676
2026-04-17 15:52 UTC
@slink@fosstodon.org @0xKaishakunin@mastodon.social reproducible builds are great but in some ways orthogonal to "how to sign".
One benefit you can only really get from fully reproducible builds is that multiple devs can build, confirm and sign with their own keys.
Replies (1)
-
@groved@mastodon.social 2026-04-18 01:51
@meejah@mastodon.social @slink@fosstodon.org @0xKaishakunin@mastodon.social Reproducible builds only go so far though. Unless you're runners linux distro, build toolchain and deps are full-source bootstrapped and reproducible, you don't fully know that you're not compromised. @meejah@mastodon.social is correct thought, this is an orthogonal thing. If you have multiple runners building the code separately and hermetically and they come back reproducible, you do have a much better guarantee about the software.