Reproducible builds could be use to verify that it is the case. Packages with build profiles must offer the exact same functionality for all profiles. deb files whose contents didn't really change between versions. Allow file-level deduplication on Debian mirror sites, or maybe snapshots.d.o, of.Only if the hash matches the upload gets accepted. deb files but keep them referenced in the.
#Pcworld file deduplicator archive
The archive could be made to only accept reproducible uploads: the maintainer would stop uploading. Ensure packages can be built from source.Be able to generate debug symbols for packages which do not have a “debug package”.Help Multi-Arch: same packages co-installation (as they need every matching file to be byte identical). Finally, with a sufficiently large body of independent (geographically and administratively) machines, reproducible builds can help find systems which are compromised in a way to produce binaries with altered functionality.Additionally, the incentive for this kind of attack is further lowered because an attacker now has to compromise all machines that can check the reproducibility of the uploaded source.Should reproducible uploads become mandatory, then the incentive of an attacker to compromise the system of a developer with upload rights is lowered because it is not anymore possible for the developer to upload a binary that does not match the uploaded sources.Allow independent verifications that a binary matches what the source intended to produce.
0 kommentar(er)
