The FreeBSD Foundation has announced the implementation of support for reproducible builds, allowing verification that the distributed binary files are compiled from the provided source code and contain no hidden changes. At the same time, it has been stated that there will be an option to build FreeBSD in unprivileged environments that do not require root privileges. Removing components executed during the build process with root rights will enhance the security of the FreeBSD release infrastructure, reduce the attack surface for the build environment, and simplify the organization of automated builds.
During the build stage, root privileges were necessary for creating device files, setting permissions, and mounting additional file systems (for example, when creating disk images). Changes to replace such actions with operations that do not require root privileges have been added to the experimental branch of FreeBSD but will later be transferred to the branch on which FreeBSD 15.0 is based. In addition to building a release from the source code, artifacts such as iso-images for creating installation and bootable flash drives, and system images can now also be created without root rights. of virtual machines and cloud platforms.
As for reproducible builds, they enable identical binary files to be produced from source code across different build environments. Anyone can now personally verify that the distributed binary files are compiled from the provided source texts, without merely relying on trust in the project’s build infrastructure, as compromise of the compiler or build tools could lead to the insertion of hidden backdoors.
When creating reproducible builds, details such as exact dependency matches, the use of immutable build tool compositions and versions, identical sets of options and default settings, preservation of the order of file assembly (applying the same sorting methods), and disabling the compiler from adding non-deterministic metadata like random values, file path references, and build date and time data are taken into account. Build reproducibility can also be affected by toolchain bugs and race conditions.
Source: opennet.ru
