[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130925080801.GA5979@suse.de>
Date: Wed, 25 Sep 2013 10:08:01 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: Reproducible Builds for Fedora
Hi
cool stuff indeed and certainly a benefit.
On Tue, Sep 24, 2013 at 09:55:13PM +0530, Dhiru Kholia wrote:
> Hi,
>
> I have been working on having Reproducible Builds in Fedora for some
> time.
>
> At this point, I think I have something demoable. Ensuring Reproducible
> Builds is a big task and I want your feedback, ideas, code and support.
>
Since you asked for support, here's my idea. I hope I am not nitpicking, but
the whole idea behind reproducable builds is to avoid trojaned rpm's,
I guess.
I was checking the rpm-compare how it actually is doing the compre
and you have:
[...]
base=`basename $f`
objdump -d rpm1/$f | grep -v $base > dump1
objdump -d rpm2/$f | grep -v $base > dump2
diff -u dump1 dump2 > /dev/null
if [ $? -ne 0 ] ; then
echo "File disassembly differs $f"
cnt=`expr $cnt + 1`
fi
[...]
for ELF files and doing a sha256sum for other file types. My concern is
that attackers could construct a package that contains function-names that
match the basename of the binary that you are checking. The "grep -v"
will remove that, leaving a clean compare for injected code like
'call $base' etc. That would leave a wrong feeling about equal binaries.
regards,
Sebastian
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
