There might be non-security benefits of reproducible builds to *vendors*, but I don't see any benefit to users of being able to reproduce them. This is just because promising there's no backdoors make no sense when bugdoors are just so perfect?
I think they can prove the build server wasn't compromised, but for the sake of discussion, let's say it doesn't. What is the attack you're imagining, is the vendor malicious in your scenario? If not, how did the attacker get the build codesigned?
-
-
Yes the vendor, especially in CI/CD of native code on Windows with Visual Studio in Azure for example. I can run BlackDuck and static-analysis and unit tests, but I don't have access to CL.exe's source, so I have to trust MS et al, and in turn I sign my code..
-
Essentially the customer trusts us and we trust MS and MS trusts hardware companies and we pray that open source tools save us all, from signing to static analysis, which might explain some justification to using clang for intellicode etc
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
