10 ms·

That's no different from how NixOS does it. You are still comparing hashes from the first build done by the distribution. A more pure approach would be to use t

That's no different from how NixOS does it. You are still comparing hashes from the first build done by the distribution. A more pure approach would be to use the source code files (simple sha256sum will suffice) as the first independent variable in the chain of trust.

__MatrixMan__ 2y ago
I'm not sure what you mean. It's your machine that calculates the hashes when it encounters the code. If you bulld the directed graph made by the symlinks in the nix store, and walk it backwards, a sha256 of the source files is what you'll find, both in the form of a nix store path and possibly in a derivation that relies on a remote resource but provides a hash of that resource so we can know it's unchanged when downloaded later. The missing piece is that they're not gossipped between users. So if I find some code in a dark alley somewhere and it has a nix flake to make building it easy, I've got no way to take the hashes and determine who else has experience with the same code and can help me decide if it's trustworthy.
- mschwaig 2y ago
  There are also some other gaps left to close to implement this vision, mentioned in this post an my reply to it: https://news.ycombinator.com/item?id=43030046 https://news.ycombinator.com/item?id=43030046
  - __MatrixMan__ 2y ago
    I've opened a tab to your paper and I'll be reading it, thanks for the link
    - mschwaig 2y ago
      That's great. Feel free to reach out if you want to, I'm happy to answer any questions. It's basically my job, that I really love. :)
- Timber-6539 2y ago
  If your builder is compromised, it can be co-opted to sign and verify the "source code" files with any values. The risk of placing this trust in the builder or the nix store is an easy one to avoid. Getting the authencity of the code from the source code independently ought to be the correct way of verifying reproducible builds.
  - __MatrixMan__ 2y ago
    You mean like, as a signature made by the code's author? Hmm that feels a bit too much like a root of trust, those make me uncomfortable. I'm more interested in tooling for gathering metadata re: the trustworthiness of some code without the author's participation. If the author wants to be involved, all the better.
    - Timber-6539 2y ago
      The code author could make a signature on every release which would be the strongest guarantee of authenticity. But at a rudimentary level, we could have code hosting repositories simply publish/advertise the sha256 values of the hosted code files. The root of trust has to lay at the source code origin for a pure implementation of reproducible builds and for the security reasons I mentioned earlier. In general it doesn't help much IMO to have distributions take a silo view of the problem. But those are just my ideas and thoughts on the matter.

__MatrixMan__ 2y ago

I'm not sure what you mean. It's your machine that calculates the hashes when it encounters the code. If you bulld the directed graph made by the symlinks in the nix store, and walk it backwards, a sha256 of the source files is what you'll find, both in the form of a nix store path and possibly in a derivation that relies on a remote resource but provides a hash of that resource so we can know it's unchanged when downloaded later. The missing piece is that they're not gossipped between users. So if I find some code in a dark alley somewhere and it has a nix flake to make building it easy, I've got no way to take the hashes and determine who else has experience with the same code and can help me decide if it's trustworthy.

mschwaig 2y ago
There are also some other gaps left to close to implement this vision, mentioned in this post an my reply to it: https://news.ycombinator.com/item?id=43030046 https://news.ycombinator.com/item?id=43030046
- __MatrixMan__ 2y ago
  I've opened a tab to your paper and I'll be reading it, thanks for the link
  - mschwaig 2y ago
    That's great. Feel free to reach out if you want to, I'm happy to answer any questions. It's basically my job, that I really love. :)
Timber-6539 2y ago
If your builder is compromised, it can be co-opted to sign and verify the "source code" files with any values. The risk of placing this trust in the builder or the nix store is an easy one to avoid. Getting the authencity of the code from the source code independently ought to be the correct way of verifying reproducible builds.
- __MatrixMan__ 2y ago
  You mean like, as a signature made by the code's author? Hmm that feels a bit too much like a root of trust, those make me uncomfortable. I'm more interested in tooling for gathering metadata re: the trustworthiness of some code without the author's participation. If the author wants to be involved, all the better.
  - Timber-6539 2y ago
    The code author could make a signature on every release which would be the strongest guarantee of authenticity. But at a rudimentary level, we could have code hosting repositories simply publish/advertise the sha256 values of the hosted code files. The root of trust has to lay at the source code origin for a pure implementation of reproducible builds and for the security reasons I mentioned earlier. In general it doesn't help much IMO to have distributions take a silo view of the problem. But those are just my ideas and thoughts on the matter.