Post #2588999
2026-05-13 18:33 UTC
Replies (3)
-
@kemotep@mastodo.neoliber.al 2026-05-13 19:00
@dangoodin@infosec.exchange it would not have caught the xz attack. But is the point of reproducible builds more about consistency and reliability than security?
-
@cazabon@mindly.social 2026-05-13 21:15
@dangoodin@infosec.exchange As others have noted, that's not the purpose of reproducible builds. The problem they solve is "When I download the source code and build it, the binaries are different from the ones provided by the original source, and I have no idea why or whether those differences are incidental, functional, or the result of the source binaries being built from different source code than what is published for them". It's a long-wished-for safety blanket.
-
@gnomon@mastodon.social 2026-05-14 02:24
@dangoodin@infosec.exchange the point of reproducible builds is much more about solidifying the foundations of build and delivery pipelines than about SBOM sealing. Reproducible builds may incrementally ease that work a bit, but that's a secondary benefit and not the main point of the work.