Reproducible builds in Debian and everywhere Lunar - PowerPoint PPT Presentation

Test (and test again) Lunar (Debian) Reproducible builds LSM2015 34 / 126

Finding variations Build the package Re build the package Compare the results Lunar (Debian) Reproducible builds LSM2015 35 / 126

reproducible.debian.net Continuous test system driven by Jenkins Bad ass hardware sponsored by ProfitBricks Tests about 1300 source packages each day on average Results are visible on a website Recent additions: Coreboot and OpenWrt Lunar (Debian) Reproducible builds LSM2015 36 / 126

Variations for Debian packages The second build differs by: time timezone file ordering process ordering cores used for the build Lunar (Debian) Reproducible builds LSM2015 37 / 126

Variations for Debian packages hostname, domainname username, uid, gid umask language ( LANG ) and locale ( LC_ALL ) kernel version (using linux64 --uname-2.6 ) PATH Lunar (Debian) Reproducible builds LSM2015 38 / 126

Still the same for now date ( but we cheat with timezone ) /proc/cpuinfo rebuilds on different filesystems (currently tmpfs only) Are we forgetting something? Lunar (Debian) Reproducible builds LSM2015 39 / 126

Findings Lunar (Debian) Reproducible builds LSM2015 40 / 126

Identified issues Timestamps (recording current time) File order (Pseudo-)randomness: Lunar (Debian) Reproducible builds LSM2015 41 / 126 ◮ Temporary file paths ◮ UUID ◮ Protection against complexity attacks

Identified issues (cont.) CPU and memory related: Build-path Others, eg. locale settings Lunar (Debian) Reproducible builds LSM2015 42 / 126 ◮ Code optimizations for current CPU class ◮ Recording of memory addresses

Identified issues (cont.) Examples Timestamps added by build systems Lunar (Debian) Reproducible builds LSM2015 43 / 126

Timestamps in gzip headers Lunar (Debian) Reproducible builds LSM2015 44 / 126

Timestamps written by Maven Lunar (Debian) Reproducible builds LSM2015 45 / 126

Timestamps in generated Makefiles Lunar (Debian) Reproducible builds LSM2015 46 / 126

Timestamps in header files Lunar (Debian) Reproducible builds LSM2015 47 / 126

Timestamps written by PyQt4 Lunar (Debian) Reproducible builds LSM2015 48 / 126

Timestamps written by Erlang compiler Lunar (Debian) Reproducible builds LSM2015 49 / 126

Timestamps in PE binaries Windows, UEFI, Mono… Lunar (Debian) Reproducible builds LSM2015 50 / 126

Timestamps in ADA library information Lunar (Debian) Reproducible builds LSM2015 51 / 126

Timestamps in Ruby gemspec files Lunar (Debian) Reproducible builds LSM2015 52 / 126

Timestamps in PHP registry Lunar (Debian) Reproducible builds LSM2015 53 / 126

Timestamps by a template engine Lunar (Debian) Reproducible builds LSM2015 54 / 126

Timestamps in Python version Lunar (Debian) Reproducible builds LSM2015 55 / 126

Identified issues (cont.) Examples Archives Lunar (Debian) Reproducible builds LSM2015 56 / 126

Timestamps in static libraries Lunar (Debian) Reproducible builds LSM2015 57 / 126

Timestamps in static libraries (cont.) Lunar (Debian) Reproducible builds LSM2015 58 / 126

Timestamps in ZIP archives Lunar (Debian) Reproducible builds LSM2015 59 / 126

Timestamps in Java jar They are actually ZIP archives. Lunar (Debian) Reproducible builds LSM2015 60 / 126

Timestamps in tarballs Lunar (Debian) Reproducible builds LSM2015 61 / 126

Users and groups in tarballs Lunar (Debian) Reproducible builds LSM2015 62 / 126

Random order in tarballs Lunar (Debian) Reproducible builds LSM2015 63 / 126

Identified issues (cont.) Examples Timestamps in documentation Lunar (Debian) Reproducible builds LSM2015 64 / 126

Timestamps written by Doxygen Lunar (Debian) Reproducible builds LSM2015 65 / 126

Timestamps written by docbook-to-man Lunar (Debian) Reproducible builds LSM2015 66 / 126

Timestamps written by Groovydoc Lunar (Debian) Reproducible builds LSM2015 67 / 126

Timestamps written by Epydoc Lunar (Debian) Reproducible builds LSM2015 68 / 126

Timestamps written by Sphinx Lunar (Debian) Reproducible builds LSM2015 69 / 126

Timestamps written by Ghostscript Lunar (Debian) Reproducible builds LSM2015 70 / 126

Timestamps written by LaTeX Lunar (Debian) Reproducible builds LSM2015 71 / 126

Timestamps written by texi2html Lunar (Debian) Reproducible builds LSM2015 72 / 126

Timestamps written by texi2html (cont.) Lunar (Debian) Reproducible builds LSM2015 73 / 126

Timestamps written by help2man Lunar (Debian) Reproducible builds LSM2015 74 / 126

Timestamps written by GNU groff Lunar (Debian) Reproducible builds LSM2015 75 / 126

Timestamps written by Javadoc Lunar (Debian) Reproducible builds LSM2015 76 / 126

Timestamps written by man2html Lunar (Debian) Reproducible builds LSM2015 77 / 126

Timestamps in TeX output (.dvi) Lunar (Debian) Reproducible builds LSM2015 78 / 126

Identified issues (cont.) Examples “Compiled at/on/by” Lunar (Debian) Reproducible builds LSM2015 79 / 126

Build time via C preprocessor macros Lunar (Debian) Reproducible builds LSM2015 80 / 126

Build time via C preprocessor macros Lunar (Debian) Reproducible builds LSM2015 81 / 126

Build time recorded via Makefile Lunar (Debian) Reproducible builds LSM2015 82 / 126

Hostname recorded via ./configure Lunar (Debian) Reproducible builds LSM2015 83 / 126

Build time recorded via ./configure Lunar (Debian) Reproducible builds LSM2015 84 / 126

m4 macros for autoconf (build time) Lunar (Debian) Reproducible builds LSM2015 85 / 126

m4 macros for autoconf (username) Lunar (Debian) Reproducible builds LSM2015 86 / 126

m4 macros for autoconf (hostname) Lunar (Debian) Reproducible builds LSM2015 87 / 126

Recorded kernel version Lunar (Debian) Reproducible builds LSM2015 88 / 126

Bonus points for programmers Lunar (Debian) Reproducible builds LSM2015 89 / 126

Identified issues (cont.) Examples File ordering Lunar (Debian) Reproducible builds LSM2015 90 / 126

File ordering in python-support files Lunar (Debian) Reproducible builds LSM2015 91 / 126

Identified issues (cont.) Examples Randomness Lunar (Debian) Reproducible builds LSM2015 92 / 126

Random Perl hash order See Algorithmic complexity attacks in perlsec(1). Lunar (Debian) Reproducible builds LSM2015 93 / 126

Random serial numbers in Ogg streams Lunar (Debian) Reproducible builds LSM2015 94 / 126

Random import order in Python code Lunar (Debian) Reproducible builds LSM2015 95 / 126