oss-security - Re: Mitigating malicious packages in gnu/linux

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <877e3vrh4v.fsf@gnu.org>
Date: Tue, 19 Nov 2019 17:00:00 +0100
From: Ludovic Courtès <ludo@....org>
To: Tim Kuijsten <info+oss-security@...send.nl>
Cc: oss-security@...ts.openwall.com
Subject: Re: Mitigating malicious packages in gnu/linux

Hi,

Tim Kuijsten <info+oss-security@...send.nl> skribis:

>> There is not a definitive solution here. But there are multiple efforts and
>> research going on. The most important one, in my opinion, is the reproducible
>> builds project [1]. We need to ensure we are not inserting random or
>> non-deterministic data into our build artifacts. This stretches from upstream
>> developers providing tarballs, to pre-compiled sources and packages from
>> distributions. There is no distribution today that has full reproducible builds,
>> but there are many projects that work towards this and work on reproducible
>> builds.
>
> One attack that is not solved by reproducible builds is one on the toolchain.
> This can be solved with bootstrappable builds[1] which is about minimizing the
> number of trusted binaries that are needed to produce the toolchain, that
> produced the toolchain, ... that was used to build your package.

Efforts in that area are fruitful and have already led to a smaller set
of “bootstrap seeds” (binaries from which the rest of the system is
built from source) for GNU Guix, an important step forward:

  https://guix.gnu.org/blog/2019/guix-reduces-bootstrap-seed-by-50/

Thanks to people working on GNU Mes and related projects at
<https://bootstrappable.org/>, we have good hope to see that set of
bootstrap seeds further reduced soon.

Reproducible builds and bootstrappable builds enable provenance tracking
and auditing, which are key to security.

Ludo’.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.