Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds...
Transcript of Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds...
![Page 1: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/1.jpg)
Reproducible Builds in FreeBSD
AsiaBSDCon 2017Tokyo, Japan
2017-03-12
![Page 2: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/2.jpg)
About Me
I FreeBSD user since early 2000sI FreeBSD committer since 2005I FreeBSD Foundation since 2011I Reproducible builds since 2015
![Page 3: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/3.jpg)
Source code
![Page 4: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/4.jpg)
Source code
Binary artifact
Build process
![Page 5: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/5.jpg)
![Page 6: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/6.jpg)
=
![Page 7: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/7.jpg)
=
![Page 8: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/8.jpg)
=
=
![Page 9: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/9.jpg)
Definition
A build is reproducible if given the same sourcecode, build environment, and buildinstructions, any party can recreate bit-by-bitidentical copies of all specified artifacts.
The relevant attributes of the build environment, thebuild instructions, and the source code as well as theexpected reproducible artifacts are defined by theauthors or distributors. The artifacts of a build arethe parts of the build results that are the desired,primary output.
https://reproducible-builds.org/docs/definition/
![Page 10: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/10.jpg)
Why?
I Software Integrity / AssuranceI Practical Reasons
![Page 11: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/11.jpg)
Practical Reasons
I Reduce package repository storage size (ifstoring every build)
I Reduce bandwidth used by package mirrors andend host updates
I Create minimal-size binary patchesI Facilitate retroactive debug data creationI Accurate ports tree exp-runs – track:
I Changing toolchain componentsI Packages impacted by a change in a headers or
macrosI Packages using static librariesI Improved packaging Q/A
![Page 12: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/12.jpg)
Software Assurance
“Reproducible builds are a set of softwaredevelopment practices which create a verifiablepath from human readable source code to the
binary code used by computers.”
https://reproducible-builds.org/
![Page 13: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/13.jpg)
Software Assurance
Can be audited
Can be used
![Page 14: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/14.jpg)
XCode Malware
![Page 15: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/15.jpg)
31c3 Perry and Schoen
https://media.cc.de "Moving Beyond Single Points of Failure"
![Page 16: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/16.jpg)
Reflections on Trusting Trust
![Page 17: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/17.jpg)
Who is Involved
![Page 18: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/18.jpg)
Who’s InvolvedI F-DroidI BitcoinI TorI SignalI OpenSUSEI UbuntuI GuixI NixOSI ElectroBSDI QubesI TAILSI Subgraph
![Page 19: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/19.jpg)
Components of Reproducible Builds
I Deterministic build systemI Reproducible build environmentI Distributing the build environmentI Rebuilding and checking the results
![Page 20: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/20.jpg)
Deterministic build system
I Stable inputsI Stable outputsI Capture as little as possible from the
environment
![Page 21: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/21.jpg)
Reproducing the build environment
I Build tools and versionsI Build architectureI Operating systemI Build pathI Build date and timeI ...I FreeBSD base system provides a shortcut
![Page 22: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/22.jpg)
Distributing the build environment
I Fetch and build known toolchainI Integrated toolchain sourceI Packaged toolchainI GitianI ContainersI VM imagesI ...I FreeBSD base system provides a shortcut
![Page 23: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/23.jpg)
Sources of nonreproducibility
I Embedded build informationI Input file ordering (filesystem, locale)I Archive metadataI Unstable output ordering (e.g. hashes)I Intentional randomnessI DWARF debug info pathsI Threaded producersI OptimizationsI Value initializationI Embedded signatures
![Page 24: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/24.jpg)
VariationsI hostname, domainnameI Environment: TZ, LANG, LC_ALL, USERI Timestamp, Y/M/D H:M:SI Year or dateI uid, gidI Kernel versionI 32- or 64-bit kernelI shellI umaskI CPU typeI filesystemI path?
![Page 25: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/25.jpg)
Reproducible FreeBSD
I BaseI PortsI Doc
![Page 26: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/26.jpg)
FreeBSD base
I Under our controlI Almost done
I One material open issue affecting FreeBSD-updateI One material open issue affecting pkg baseI ReproducibleBuilds wiki page created in 2013I Prompted by FreeBSD-update
![Page 27: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/27.jpg)
FreeBSD base - fixed
I Build date in /usr/include/osreldate.hI Build host and user in /usr/sbin/amdI Build date and time in /usr/sbin/bhyveI Build date and time in /etc/mail/*.cfI Build date in/usr/share/doc/psd/13.rcs/paper.ascii.gz
![Page 28: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/28.jpg)
FreeBSD base - fixed
Build host, user, path and time in/var/db/mergemaster.mtree
# user: emaste# machine: example# tree: /var/tmp/temproot.fFki3iM9# date: Sun Apr 10 12:19:52 2016
# ./set type=file. type=dir
aliases type=linkamd.map size=208 md5digest=e24ec9e1b9da870742a17669e69309a6apmd.conf size=1233 md5digest=ad61867e7088f15356ce7a123b909859auth.conf size=230 md5digest=5ced0a5986b19b6e60dcf25ca6d860b0crontab size=723 md5digest=26d10036869afb3fd0569d9c09d44c4ccsh.cshrc size=106 md5digest=0fb9d8e625dcdaa81f70ee308c8135d6...
![Page 29: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/29.jpg)
FreeBSD base - fixed
Build user, date and time in /boot/loader/loaderand other loaders
BTX loader 1.00 BTX version is 1.02Consoles: internal video/keyboardBIOS drive C: is disk0BIOS 638kB/1046464KB available memory
FreeBSD/i386 bootstrap loader, Revision 1.1([email protected], Thu Jan 1 09:55:10 UTC 2009)Loading /boot/defaults/loader.conf
Currently requires non-default setting
![Page 30: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/30.jpg)
FreeBSD base - fixed
Build user, date and time in /boot/kernel/kernel
% uname -vFreeBSD 9.1-RELEASE #0 r243825: Tue Dec 4 09:23:10 UTC 2012root at farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
Currently requires non-default setting
![Page 31: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/31.jpg)
FreeBSD base - fixed
I Date or other metadata in filesystem imageproduced by makefs in/tests/sys/geom/class/uzip
I makewhatis output depends on man page deviceand inode numbers
![Page 32: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/32.jpg)
FreeBSD base - TODO
I Full paths in non-debug sections in kernelmodules
I Host, not in-tree, makewhatis used byFreeBSD-update builds
![Page 33: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/33.jpg)
FreeBSD ports
I Ports do not enforce build environment(user, host name, path, ...)
I Variation good for identifying nonreproducibilityI We want to facilitate reproducibilityI Poudrière
![Page 34: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/34.jpg)
FreeBSD packages
I PortsReproducibleBuilds wiki page created inMarch 2015 (swills@)
I Initial patch sets stage dir timestamps to that ofthe newest distfile
I Builds vary the hostname, time, and dateI 15164 of 23599 packages reproducible (64.25%)
![Page 35: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/35.jpg)
FreeBSD packages
I Second iteration by bapt@I Record timestamp in make makesum during port
updateI Ports r415078 by emaste@
I Use timestamp for pkg archive metadataI Use timestamp as SOURCE_DATE_EPOCH in build
environment
![Page 36: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/36.jpg)
Use timestamp for pkg archive metadataNon-reproducible 5162Reproducible 20009Failed 4
I Example non-reproducible packages:GraphicsMagick, R-* (181), ansible, apache-openoffice, apache24,aspell, autoconf, automake, avrdude, bind910, busybox, clamav,cmake, couchdb, courier, crashmail, cyrus-imapd25, dbus, distcc,dpkg, elixir-* (61), erlang-* (63), exim, fpc-* (90), ficl, firefox,gcc, git, go, hadoop2, inkscape, kBuild, kde-runtime, lastpass-cli,libav, libdjbdns, libgcrypt, libgpg-error, libidn, liblz4, libtool, libxul,llvm38, m4, mongodb, node, octave-* (91), openjdk,openldap-server, openvpn, owncloudclient, p5-* (747), php56,py27-* (195), python27, python34, qemu, ruby, rubygem-* (1175),samba44, squid, subversion, tcl86, tex-luatex, thunderbird,u-boot-* (11), valgrind, virtualbox-ose, vlc, wine, yacc, yasm
![Page 37: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/37.jpg)
Set SOURCE_DATE_EPOCH in buildenvironment
Non-reproducible 3534Reproducible 5062Failed 4
I Example packages of 116 more nowreproducible:calibre, cherivis-devel, cmake, easydiff, freetar, gforth, gnumail,gnustep-wrapper, kbreakout, net-snmp, mongodb32, terminal.app
![Page 38: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/38.jpg)
Set SOURCE_DATE_EPOCH in buildenvironment + Clang patch
Non-reproducible 4011Reproducible 4549Failed 5
I Example packages of 514 more nowreproducible:abiword, analog, apache22, audacity, avrdude, bind99, bind910,clamav, crashmail, ctags, distcc, efax, exim, inkscape, libcaca,liblz4, llvm-cheri128, nagios4, nasm, rrdtool, subversion, x264,xchat, unzip
![Page 39: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/39.jpg)
SOURCE_DATE_EPOCHD2032 Stock pkg +build env +Clang
Non-reproducible 15164 25222 5162 3534 4011Reproducible 8435 0 20009 5062 4549Failed 824 875 4 5Reproducible % 64.26% 0% 79.49% 79.89% 81.92%
![Page 40: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/40.jpg)
FreeBSD packages
![Page 41: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/41.jpg)
Investigating Changes
![Page 42: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/42.jpg)
What changed?
I (1) nginx-1.10.0_3,2.txz bb31ba88b568...
I (2) nginx-1.10.0_3,2.txz bb31ba88b568...
I (1) avrdude-6.1_1.txz 0a3811a78a03...
I (2) avrdude-6.1_1.txz 7336a6d85dd6...
![Page 43: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/43.jpg)
What changed?
I (1) nginx-1.10.0_3,2.txz bb31ba88b568...
I (2) nginx-1.10.0_3,2.txz bb31ba88b568...
I (1) avrdude-6.1_1.txz 0a3811a78a03...
I (2) avrdude-6.1_1.txz 7336a6d85dd6...
![Page 44: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/44.jpg)
What changed?
I (1) nginx-1.10.0_3,2.txz bb31ba88b568...
I (2) nginx-1.10.0_3,2.txz bb31ba88b568...
I (1) avrdude-6.1_1.txz 0a3811a78a03...
I (2) avrdude-6.1_1.txz 7336a6d85dd6...
![Page 45: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/45.jpg)
Diffoscope
I Examine differences in depthI Output HTML or plain textI Recursively unpack archivesI Human readable output
I Uncompress .PDF, disassemble binaries
I https://diffoscope.orgI FreeBSD port sysutils/diffoscopeI Online version https://try.diffoscope.org
![Page 46: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/46.jpg)
Diffoscope
I ArchivesI bzip2, .cpio, .deb, gzip, .ipk, iso9660, RPM,
squashfs, .tar, .xz, .zipI Formats
I Debian .changes, TrueType & OpenType fonts,gettext .mo, .class, Mono .exe, PDF, PNG,sqlite3 databases, text files
I Contributions welcome!
![Page 47: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/47.jpg)
Nonreproducible binaryExample
% cat hello.c#include <stdio.h>
intmain(int argc, char *argv[]){
puts("Hello, World compiled at "__TIME__ " on " __DATE__ "\n");
}% cc -o hello_1 hello.c% cc -o hello_2 hello.c
![Page 48: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/48.jpg)
Diffoscope output
![Page 49: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/49.jpg)
Diffoscope archives
Example
% cc -o hello hello.c% tar -cJxf hello_1.txz hello% cc -o hello hello.c% tar -cJxf hello_2.txz hello
![Page 50: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/50.jpg)
Diffoscope HTML output
![Page 51: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/51.jpg)
Diffoscope
I Diffoscope is a debugging / diagnostic toolI “Reproducible” means bit-for-bit identicalI cmp / diff / sha256 test for reproducibility
![Page 52: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/52.jpg)
Debian’s Experience - CI
![Page 53: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/53.jpg)
Debian’s Experience - Bugs
![Page 54: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/54.jpg)
Debian’s Experience - Buy-in
I Provide good arguments on why reproduciblebuilds matter
I ROI on security-related work not always apparent
I Continuous integration to track progressI Reproducibility bugs come with patches
![Page 55: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/55.jpg)
Debian’s Experience - Policy
I Debian Policy ManualI Structure and contents of the Debian archiveI Design issues of the operating systemI Technical requirements packages must satisfy to be
included
I Proposed section:“Source must build in a reproducible manner”
![Page 56: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/56.jpg)
OK - Now what?
I Builders / RebuildersI Distribution of reproduction resultsI User interface
![Page 57: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/57.jpg)
Thank you
![Page 58: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/58.jpg)
Links
I Reproducible Builds https://reproducible-builds.org/
I Diffoscope https://diffoscope.org/
I FreeBSD Reproducible Builds wikihttps://wiki.freebsd.org/ReproducibleBuilds
I FreeBSD Reproducible Ports wikihttps://wiki.freebsd.org/PortsReproducibleBuilds
I Debian Reproducible Builds wikihttps://wiki.debian.org/ReproducibleBuilds
I Diverse Double-Compilationhttp://www.dwheeler.com/trusting-trust/
![Page 59: Reproducible Builds in FreeBSDemaste/2017-03-12-AsiaBSDCon... · 2017-03-10 · Reproducible Builds in FreeBSD Ed Maste emaste@freebsd.org AsiaBSDCon 2017 Tokyo, Japan 2017-03-12](https://reader030.fdocuments.us/reader030/viewer/2022040904/5e77b3cf0a64ba7af829be58/html5/thumbnails/59.jpg)
Copyright c© 2016–2017Ed Maste [email protected].
Copyright c© 2014–2016Holger Levsen [email protected] and others.
Copyright of images included in this document are held by their respective owners.
This work is licensed under the Creative Commons Attribution-Share Alike 3.0 License. To view a copyof this license, visit http://creativecommons.org/licenses/by-sa/3.0/ or send a letter to CreativeCommons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA.