Fedora is implementing a change to enhance package reproducibility, aiming for a 99% success rate. This involves using "source date epochs" (SDE) which fixes build timestamps to a specific point in the past, eliminating variations caused by differing build times. While this approach simplifies reproducibility checks and reduces false positives, it won't address all issues, such as non-deterministic build processes within the software itself. The project is actively seeking community involvement in testing and reporting any remaining non-reproducible packages after the SDE switch.
The blog post details a potential supply chain attack vector targeting Linux distributions, specifically focusing on Fedora's now-deprecated Pagure code hosting platform. The author discovered that Pagure's design allowed maintainers to incorporate external dependencies, such as automatically fetched tarballs from arbitrary URLs, directly into build processes. This posed a significant security risk as compromised external servers could inject malicious code into these dependencies, which would then be incorporated into Fedora packages. While Fedora itself wasn't directly affected due to its use of mock for isolated builds, the author argues the vulnerability highlighted a broader systemic issue in open-source software supply chains where implicit trust in external resources can be exploited. The post concludes by emphasizing the need for stricter dependency management and verification practices within Linux distributions and the open-source ecosystem.
HN commenters discuss the complexities of securing the software supply chain, particularly for Linux distributions. Some express skepticism about the feasibility of perfect security, noting the difficulty in verifying every component and the potential for vulnerabilities to be introduced at various stages. Others suggest focusing on minimizing the "blast radius" of potential attacks through techniques like reproducible builds and better compartmentalization. The conversation also touches on the trade-offs between security and convenience, with some arguing that the current level of risk is acceptable given the benefits of open-source software and rapid development cycles. A few comments delve into specific technical details, such as the use of signed RPM packages and the role of distribution maintainers in verifying software integrity. Finally, there's a discussion about the potential for malicious actors to target infrastructure like package repositories and the importance of robust security measures at that level.
Fedora 42 Beta is now available for testing, bringing updates across the desktop, server, and cloud. Key features include the GNOME 44 desktop environment with improved quick settings and a redesigned file chooser, the Linux 6.4 kernel, and Golang 1.20. For server users, Fedora 42 defaults to a more minimal install, reducing attack surface and resource usage. The cloud image incorporates these updates and is prepared for deployment on various platforms. Testers are encouraged to download the beta release and provide feedback to help ensure a polished final release.
HN users discuss the changes in Fedora 42 Beta. Several commenters express excitement about the switch to GNOME 44, praising its improved performance and features like quick settings toggles for Bluetooth. Others appreciate the inclusion of newer kernel and Golang versions. Some users discuss the decision to drop support for i686, with mixed reactions. A few commenters also mention their preferred desktop environments, like KDE and Sway, and their experiences with Fedora Kinoite. The transition to a new bootloader, BLS, is also mentioned but doesn't generate extensive discussion.
Summary of Comments ( 195 )
https://news.ycombinator.com/item?id=43653672
Hacker News users discuss the implications of Fedora's push for reproducible builds, focusing on the practical challenges. Some express skepticism about achieving true reproducibility given the complexity of build environments and dependencies. Others highlight the security benefits, emphasizing the ability to verify package integrity and prevent malicious tampering. The discussion also touches on the potential trade-offs, like increased build times and the need for stricter control over build processes. A few commenters suggest that while perfect reproducibility might be difficult, even partial reproducibility offers significant value. There's also debate about the scope of the project, with some wondering about the inclusion of non-free firmware and the challenges of reproducing hardware-specific optimizations.
The Hacker News post "Fedora change aims for 99% package reproducibility" generated a moderate discussion with several insightful comments. Many commenters expressed support for the initiative, viewing reproducible builds as a crucial step towards enhancing software security and trustworthiness.
One compelling comment highlighted the significance of reproducibility in verifying the integrity of downloaded packages, ensuring they haven't been tampered with. This resonates with the broader security concerns around supply chain attacks, where malicious actors compromise software during the build process. Reproducibility offers a mechanism to verify the authenticity of builds by independently recreating them and comparing the results.
Another commenter delved into the technical challenges of achieving full reproducibility, particularly with aspects like timestamps and build paths embedded within binaries. They emphasized the need for careful consideration of these details to ensure consistent build outputs. This point underscores the complexity of implementing reproducible builds and the meticulous effort required by package maintainers.
Some users questioned the practicality of aiming for 99% reproducibility, wondering about the remaining 1% and the potential difficulties in achieving perfect reproducibility. This prompted a discussion about the trade-offs between striving for ideal reproducibility and the pragmatic limitations imposed by certain software components or build processes.
Furthermore, a comment mentioned the importance of tools and infrastructure for verifying reproducibility, suggesting that simply rebuilding packages isn't sufficient. Robust verification mechanisms are essential for ensuring the integrity and consistency of the reproduced builds.
Several comments also touched upon the broader benefits of reproducible builds beyond security, such as easier debugging, improved transparency, and greater community involvement in the software development lifecycle. These comments showcase the wide-ranging impact of reproducible builds on the software ecosystem.
Overall, the comments on Hacker News generally demonstrate a positive reception towards Fedora's initiative for reproducible builds, recognizing its potential to improve software security and reliability. The discussion also acknowledges the technical complexities and the need for robust tooling to effectively implement and verify reproducible builds.