@timbray Deep but also shallow? I mean, xz-utils was built from source and reproducible too. Reproducibility makes auditing the source meaningful, not unnecessary.
@timbray Less autotools is always a win, of course, but it's unclear how much of a win. The obfuscation was somewhat over the top, all things considered, given that if someone is reading closely, they've probably lost at that point anyway. Also I think they could have checked the build-to-host.m4 script into the repo and run the same attack.
@rsc Heh, at this point I'd settle for “less autotools” as a first step. I’m generally pessimistic, in that I think deterministic/reproducible building has been well-proved to be a very hard problem. But I still think chipping away at the coalface is worth doing.
@timbray
My worry is that this leads to "let's just ship container images", which will make things worse in my view.
Or we just lose support for a lot of operating systems and architectures.
Autotools is awful, but they do solve a problem. @rsc
Eventually you have to trust something if not at least the folks that made the rock do math. How are they bootstrapping their compilers? What about basic tools like ls? The kernel? Drivers? UEFI?
Add comment