The developers of the openSUSE project have announced support for reproducible builds in the openSUSE Factory repository, which applies a rolling release model for software version updates and serves as the foundation for the openSUSE Tumbleweed distribution. The openSUSE Factory build configuration now ensures that the binaries distributed in packages are compiled from the provided source texts and do not contain hidden changes. For example, any user can personally verify that the offered builds are bitwise identical to the builds compiled directly from the source texts.
When forming reproducible builds, nuances such as exact dependency matching, the use of an immutable set of versions and build tools, an identical set of options and default settings, maintaining the order of file builds (applying the same sorting methods), and disabling the compiler from adding non-deterministic metadata, such as random values, file path references, and build date and time information, are all taken into account.
The ability to verify the identity of a binary build allows for reliance not just on trust in the build infrastructure. Compromising the compiler or build tools could lead to the introduction of hidden backdoors. For instance, reproducible builds were used by the openSUSE developers to eliminate malicious modifications that could appear in the repository as a result of an incident involving a backdoor added to the xz package (the compromised liblzma library used for unpacking the archive with GCC code could potentially introduce changes to the GCC code that could be exploited to insert malicious components into the built applications).
The Factory repository is not intended for end users and is primarily used by distribution developers, as stability cannot be guaranteed at any given time. System packages added to Factory undergo automated testing using the openQA framework. After testing and verifying a consistent state of dependencies, the repository content is pushed to mirrors several times a week, and a snapshot of the state is published as openSUSE Tumbleweed.
Source: opennet.ru
