Post #2176677
2026-04-18 01:51 UTC
@meejah@mastodon.social @slink@fosstodon.org @0xKaishakunin@mastodon.social
Reproducible builds only go so far though. Unless you're runners linux distro, build toolchain and deps are full-source bootstrapped and reproducible, you don't fully know that you're not compromised.
@meejah@mastodon.social is correct thought, this is an orthogonal thing. If you have multiple runners building the code separately and hermetically and they come back reproducible, you do have a much better guarantee about the software.
Replies (1)
-
@groved@mastodon.social 2026-04-18 01:54
@meejah@mastodon.social @slink@fosstodon.org @0xKaishakunin@mastodon.social Separately you then run into the signing problem. And trust around that. Any hot or warm key is always going to have a chance of compromise and beyond that if any single person has direct access to a full copy of the signing key you run the risk of a bad actor signing a bad version. OpenPGP has been the defacto signer for a long time and I don't think that is going to reasonably change anytime soon. This is a problem we've been thinking a lot about with StageX.