Un­der Gi­tian’s pro­tec­tive wings

Linux Format - - REPRODUCIBLE BUILDS -

While build re­pro­ducibil­ity as a whole is pro­gress­ing well (see the graph, right), it’ll be some time be­fore gen­eral users can join in the ef­fort for ev­ery­day pack­ages. How­ever, re­pro­ducibil­ity has been iden­ti­fied as a priority for cer­tain pack­ages, in­clud­ing the Bit­coin Core client and Tor. These projects, be­ing con­cerned with peo­ple’s (magic in­ter­net) money and pri­vacy, have good rea­son to em­brace any means of fur­ther­ing their se­cu­rity. To that end both have adopted Gi­tian for build­ing and dis­tribut­ing their bi­na­ries.

Gi­tian was de­vel­oped by the Bit­coin com­mu­nity who, be­ing a small group, re­alised that the hand­ful of ma­chines (de­vel­op­ers’ per­sonal lap­tops usu­ally) they were us­ing to build the of­fi­cial client, rep­re­sented sin­gle points of fail­ure. De­vel­op­ment started in the early Bit­coin days, back in 2011. Given the vol­umes of ac­tual money cur­rently be­ing traded on Bit­coin ex­changes to­day, one can un­der­stand the de­sire to use any tool­ing avail­able to pro­tect them.

In the case of the Tor Browser Bun­dle, Gi­tian is used in con­junc­tion with the MinGW-w64 en­vi­ron­ment to pro­vide re­pro­ducibil­ity for Win­dows builds. And cross-com­pi­la­tion tools make this pos­si­ble on Mac as well. Gi­tian is na­tive to Ubuntu and uses the Python-based VMBuilder to cre­ate a base Ubuntu VM with Qemu. Mul­ti­ple builders can then re­pro­duce this en­vi­ron­ment eas­ily and, us­ing stand, com­pare their re­sult­ing bi­na­ries. Since the Tor Browser Bun­dle in­cludes Fire­fox (sev­eral mil­lion lines of code), the ef­fort to make this re­pro­ducible (which started in 2012) un­cov­ered all kinds of hith­erto un­seen chal­lenges. These in­cluded ran­dom file or­der­ings com­ing from the multi-threaded build process, and unini­tialised me­mory in­tro­duc­ing ran­dom bits in re­sult­ing bi­na­ries.

Ogres are like onions, but not onion routers. Both are se­ri­ous about se­cu­rity though.

Newspapers in English

Newspapers from Australia

© PressReader. All rights reserved.