Deterministic builds are hard...really hard. The combined power of the Debian community has trouble getting deterministic builds, as does the Tor project.
When I think of deterministic builds, I think of the ROMs on the old GameBoy. Apparently some of the ROMs had whatever empty space was left in the fixed-size image padded with random data pulled straight out of the build host's memory. As if consistent tool versions weren't already enough of a challenge!
I'd have thought that deterministic builds are really simple unless your toolkit ecosystem is FUBAR. After all, a compiler is a simple function from input to output (unless the FUBAR ecosystem syndrome arises, as I said).
In short, if you ignore certain things when comparing binaries and make sure you build things on absolute path of the same length(!), you can tell binaries are functionally equivalent.
Comments
Deterministic builds are hard...really hard. The combined power of the Debian community has trouble getting deterministic builds, as does the Tor project.
When I think of deterministic builds, I think of the ROMs on the old GameBoy. Apparently some of the ROMs had whatever empty space was left in the fixed-size image padded with random data pulled straight out of the build host's memory. As if consistent tool versions weren't already enough of a challenge!
Just in case someone (like me) is not familiar with the concept of deterministic builds, this is a good read:
https://blog.torproject.org/blog/deterministic-builds-part-o...
Synopsis:
"deterministic builds" -- packages which are byte-for-byte identical no matter who actually builds them, or what hardware they use.
Isnt nix and guix a kind of solution that the deterministic build problem?
They produce builds with hashes of the source and all dependencies and tools used, or so I believe after skimming their manuals.
They're not really a solution if the official binaries are compiled using VC, and you want to compare to that.
Oh! I thought that was the norm. Author made it sounded like TrueCrypt doesn't and others do the way he said it.
Deterministic builds are hard...really hard.
I'd have thought that deterministic builds are really simple unless your toolkit ecosystem is FUBAR. After all, a compiler is a simple function from input to output (unless the FUBAR ecosystem syndrome arises, as I said).
Here is a not-in-depth look at what's involved in trying to generate byte-for byte binaries on msvc:
http://stackoverflow.com/questions/1180852/deterministic-bui...
In short, if you ignore certain things when comparing binaries and make sure you build things on absolute path of the same length(!), you can tell binaries are functionally equivalent.
Well, the parent poster would say that if binaries depend on the path length of build location, then that's evidence of a FUBAR toolchain :)
I don't understand, what is the problem if we have different compiled binary?
From my understanding, if you can achieve deterministic builds, it makes it easier to detect tampering.