Can your diff(1) do this?! Can your diff(1) do this?! Improving so�ware review & QA with diffoscope Improving so�ware review & QA with diffoscope Chris Lamb Chris Lamb foss-north.se foss-north.se @lolamby @lolamby April 2018 April 2018 Debian Project Leader Debian Project Leader Gothenburg, Sweden Gothenburg, Sweden
Hallå! Hallå!
Open source developer for 10+ years Debian Project Leader opensource.org board member Freelance so�ware developer
Why? Why?
Source code available for free so�ware… … everyone runs binaries Do they correspond?
Build farms Developer's machines Blackmail, law-enforcement…
1. Ensure build have identical results 2. Multiple parties compare results 3. Attacker must infect everybody simultaneously
Identical results? Identical results?
Archive formats Archive formats
Compressed formats Compressed formats
Recursive Recursive
Line ordering Line ordering
HTML output HTML output
Android boot ROMs, Android APKs, ar archives, bzip2 files, Coreboot cbfs, CPIO archives, Dalvik dex file, Debian packages, device (mknod), device tree globs, directories, docx, ELF binaries, ext filesystem images, fontconfig cache dirs, fonts, gettext catalogues, GIF images, Git repositories, GZip files, Haskell binaries, ICC colour profiles, ISO images, Java, bytecode, Javascript, JSON, LLVM binaries, Macho binaries, Mono executables, odt documentens, Ogg borbis, OpenSSH keys, Pascal binaries, PDF files, PGP/GPG keys, PNG images, PostScript, RPM images, R statistical data, Rust binaries, SQLite databases, squashfs images, symlinks, tar archives, tcpdump dumps, text files, XML documents, XZ files, ZIP archives …
Android images Android images
Berkeley DB databases Berkeley DB databases
Microso� Word Microso� Word .docx .docx
Ebooks Ebooks
Mono binaries Mono binaries
git(1) repositories repositories git(1)
Gnumeric spreadsheets Gnumeric spreadsheets
ISO images ISO images
JSON JSON
OpenDocument text documents OpenDocument text documents
Ogg audio files Ogg audio files
tcpdump(1) capture files capture files tcpdump(1)
PDF PDF
XML documents XML documents
Using diffoscope for QA Using diffoscope for QA
Just see changes you expect Just see changes you expect
Seeing "no" changes Seeing "no" changes
Security releases Security releases
Security "releases" Security "releases"
Getting started Getting started
try.diffoscope.org try.diffoscope.org
Current status Current status
Parallel processing Parallel processing Multiple previous attempts… … Juliana Oliveira working on this now
diffoscope.org diffoscope.org
Tack! Tack! @lolamby @lolamby diffoscope.org diffoscope.org lamby@debian.org lamby@debian.org chris-lamb.co.uk chris-lamb.co.uk
@lolamby @lolamby diffoscope.org diffoscope.org lamby@debian.org lamby@debian.org chris-lamb.co.uk chris-lamb.co.uk
Recommend
More recommend