Date: 10 Aug 2002 16:57:41 +0200 From: Wouter Van Hemel <wouter@pair.com> To: Colin Percival <Colin_Percival@sfu.ca> Cc: freebsd-hackers@freebsd.org Subject: Re: release variability Message-ID: <1028991462.212.32.camel@cocaine> In-Reply-To: <5.0.2.1.1.20020810024458.02035e48@popserver.sfu.ca> References: <5.0.2.1.1.20020808000218.01fcd120@popserver.sfu.ca> <5.0.2.1.1.20020810024458.02035e48@popserver.sfu.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 2002-08-10 at 15:13, Colin Percival wrote: > [...] > This raises two questions: > 1. Is there any way I can set up my system to consistently build the same > world? The user and host are of course easy to fix; I'd consider running a > daemon to reset my clock every second in order to keep the time stamps > consistent, except that I don't think it would work, and I worry that it > might break `make` anyway. I think what you're trying to do here is impossible. Every condition would have to be the same as on the initial build machine, and even then, your time will not always match. Whatever you're trying to do, it seems like the wrong solution to me... > 2. Is this really a desireable state of affairs at all? As it is, it is > practically impossible for someone to `make release` on their own and > compare their version to the official version to ensure that the build was > correct. Reproducibility and verifiability are rather important matters > when it comes to security. > There are better ways to check the integrity of the code. The most simple way I can think of, is if you e.g. install from a cd, check the md5sum. (Maybe a md5sum/pgp key could be distributed with the announcement itself?) If your code is clean, so will be your compiled software. Except when you have something (somebody?) in resident memory that screws it after installation, but this is unlikely if you just reinstalled the whole machine, and there's nothing you can do about that either way. If you sync from source and want to build a full release when one is made instead of downloading an iso (which is a pretty reasonable and common thing to do, I think), you have AFAIK no way to check if the source has not been tampered with. It might be better to download the release source packages then, those contain md5sums: ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/4.6-RELEASE/src/ ,,, but this seems like something you don't want to do? wouter To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1028991462.212.32.camel>