From f2e808bac345b5627e1d44706efc9d7dad05001b Mon Sep 17 00:00:00 2001 From: Holger Levsen Date: Tue, 29 Nov 2016 17:15:31 +0100 Subject: presentation: restructure section about r-b --- presentations/2016-11-30-Profitbricks/index.html | 224 ++++++++++++++--------- 1 file changed, 139 insertions(+), 85 deletions(-) (limited to 'presentations/2016-11-30-Profitbricks/index.html') diff --git a/presentations/2016-11-30-Profitbricks/index.html b/presentations/2016-11-30-Profitbricks/index.html index 9df78d7c..5fb53847 100644 --- a/presentations/2016-11-30-Profitbricks/index.html +++ b/presentations/2016-11-30-Profitbricks/index.html @@ -189,9 +189,9 @@ announce new nodes by codethink Package (collection) installation tests @@ -200,37 +200,42 @@ announce new nodes by codethink g-i-installation tests -
+
+

+ reproducible.debian.net +

+
    +
  • created by 379 jobs on jenkins.debian.net
  • +
+
+ +

- Ressources used by reproducible.debian.net, by architecture + tests.reproducible-builds.org/debian/

    -
  • FIXME: page is out of place here
  • -
  • 13 amd64 systems, sponsored by Profitbricks
  • -
  • 4 i386 systems, sponsored by Profitbricks
  • -
  • 22 armhf systems, sponsored by vagrant@d.o, Debian & other donations
  • -
  • soon: 8 arm64 systems, sponsored by codethink.co.uk
  • +
  • created by ~350 jobs on jenkins.debian.net
-
-

The problem

+
+

The problem: why do we need reproducible builds?

    -
  • Can inspect the source code of free software for flaws
  • +
  • One can inspect the source code of free software for flaws
  • But distributions provide binary/compiled packages
-
+

Can we trust this process?

    @@ -242,51 +247,29 @@ announce new nodes by codethink
-
+

The motivation behind "reproducible" builds is to allow verification that no flaws have been introduced during the compilation process.

+

The solution

-
    +
      FIXME wordings
    1. Ensure compilation always identical results
    2. Multiple parties compare compilation results
    3. Attacker needs to infect everybody simultaneously (or they are detected)
-
-

Challenges

-
    -
      -
    • Timestamps
    • -
    • Timezones & locales
    • -
    • Non-deterministic file ordering
    • -
    • Dictionary/hash key ordering
    • -
    • Users, groups, umask, environment variables
    • -
    • Build paths
    • -
    • Specifying the environment
    • -
    -
-
- -
-

Technical advantages

+
+

We call this Reproducible Builds.

    -
      -
    • Faster to build; saves time, money & the environment
    • -
    • Easier to test changes/revisions
    • -
    • Unsafe behaviour (eg. internet access)
    • -
    • Unreliable / non-deterministic behaviours (eg. timing)
    • -
    • Finds bugs in uncommon timezones or locales
    • -
    • Detect corrupted build environments
    • -
    • Find future build failures (eg. expired certificates)
    • -
    +
  • We think this should become the norm for free software.
@@ -297,69 +280,138 @@ announce new nodes by codethink
      -
    • Time & date
    • -
    • Hostname & domain name
    • -
    • Filesystem (disorderfs)
    • -
    • Timezone & locale
    • -
    • uid & gid
    • -
    • GECOS information, the shell & a bunch of environment variables
    • -
    • Kernel & CPU type
    • -
    • and more…
    • +
    • Time & date
    • +
    • Hostname & domain name
    • +
    • Filesystem (disorderfs)
    • +
    • Timezone & locale
    • +
    • uid & gid
    • +
    • GECOS information, the shell & a bunch of environment variables
    • +
    • Kernel & CPU type
    • +
    • and more…
-
+
+

Challenges

+
    +
      +
    • Timestamps
    • +
    • Timezones & locales
    • +
    • Non-deterministic file ordering
    • +
    • Dictionary/hash key ordering
    • +
    • Users, groups, umask, environment variables
    • +
    • Build paths
    • +
    • Specifying the environment
    • +
    +
+
+ +
 
-
+
 
-
-

2016 summit meeting

+
+

Technical advantages

    -
  • Three-day workshop in Berlin, Germany
  • -
  • Follow-up to Athens 2015 event
  • +
      +
    • Faster to build; saves time, money & the environment
    • +
    • Easier to test changes/revisions
    • +
    • Unsafe behaviour (eg. internet access)
    • +
    • Unreliable / non-deterministic behaviours (eg. timing)
    • +
    • Finds bugs in uncommon timezones or locales
    • +
    • Detect corrupted build environments
    • +
    • Find future build failures (eg. expired certificates)
    +
+
-
-
- -

- reproducible-builds.org/events/berlin2016/ -

+
+

+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+

https://try.diffoscope.org

+

-
-

Beyond Debian…

+
+

Future work

+
    -
  • coreboot, Fedora, LEDE, OpenWRT, NetBSD, FreeBSD, Arch, Qubes, F-Droid, NixOS, Guix, etc.
  • -
  • Other projects now using "our" testing framework, SOURCE_DATE_EPOCH, .buildinfo file concept
  • -
  • Reproducible Builds summits (Athens, Berlin)
  • -
  • Some challenges moving from debian- prefixes, mailing lists, etc.
  • -
  • Generic tools
  • +
  • .buildinfo files distribution unsolved
  • +
  • How to make it meaningful for end-users
  • +
  • Source code still vulnerable
-
+
 
-

Future work

+

Beyond Debian…

+

+ + + + + + + + + + + + + + + + + + + +

    +
  • Reproducible Builds summits (Athens 2015, Berlin 2016)
  • +
+

+
-
    -
  • dak (.buildinfo file support)
  • -
  • How to make it meaningful for end-users
  • -
  • Source code still vulnerable
  • +
    +

    + Ressources used by reproducible.debian.net, by architecture & sponsor +

    +
      +
    • 13 amd64 systems, sponsored by Profitbricks
    • +
    • 4 i386 systems, sponsored by Profitbricks
    • +
    • 22 armhf systems, sponsored by vagrant@d.o, Debian & other donations
    • +
    • soon: 8 arm64 systems, sponsored by codethink.co.uk
    -
    +

    Usual thanks:

    @@ -372,12 +424,14 @@ announce new nodes by codethink

    -
    +

    Todays special thanks:

    -
    - from Debian and from all folks interested in Reproducible Builds! +

      +
    • from Debian, jenkins.debian.net would not have been possible like this without your support!
    • +
    • from many many folks interested in Reproducible Builds
    • +

    -- cgit v1.2.3-70-g09d2