{"action":"created","issue":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/308","repository_url":"https://api.github.com/repos/freedomofpress/securedrop","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/308/labels{/name}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/308/comments","events_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/308/events","html_url":"https://github.com/freedomofpress/securedrop/issues/308","id":27910008,"number":308,"title":"Independently repeatable fully deterministic compilation","user":{"login":"flamsmark","id":639937,"avatar_url":"https://avatars.githubusercontent.com/u/639937?v=3","gravatar_id":"","url":"https://api.github.com/users/flamsmark","html_url":"https://github.com/flamsmark","followers_url":"https://api.github.com/users/flamsmark/followers","following_url":"https://api.github.com/users/flamsmark/following{/other_user}","gists_url":"https://api.github.com/users/flamsmark/gists{/gist_id}","starred_url":"https://api.github.com/users/flamsmark/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flamsmark/subscriptions","organizations_url":"https://api.github.com/users/flamsmark/orgs","repos_url":"https://api.github.com/users/flamsmark/repos","events_url":"https://api.github.com/users/flamsmark/events{/privacy}","received_events_url":"https://api.github.com/users/flamsmark/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2014-02-19T21:13:39Z","updated_at":"2016-05-14T04:19:32Z","closed_at":null,"body":"It should be possible for independent folks to compile SecureDrop from source and achieve exactly the same binary. Once this is possible, SecureDrop's normal release process should rely on multiple independent builders.\r\n\r\nFor added safetly, the normal release process should also expect that others are secretly building SecureDrop the same way, and provide a mechanism for issuing alerts the official builds are incorrect. This mechanism should be tested regularly (but not often). In a test, all the official builders collude to make an innocuous change (perhaps the addition of whitespace), and publish their build. Then you see how long it takes for someone to sound the alarm."},"comment":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/comments/219199655","html_url":"https://github.com/freedomofpress/securedrop/issues/308#issuecomment-219199655","issue_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/308","id":219199655,"user":{"login":"fowlslegs","id":3538418,"avatar_url":"https://avatars.githubusercontent.com/u/3538418?v=3","gravatar_id":"","url":"https://api.github.com/users/fowlslegs","html_url":"https://github.com/fowlslegs","followers_url":"https://api.github.com/users/fowlslegs/followers","following_url":"https://api.github.com/users/fowlslegs/following{/other_user}","gists_url":"https://api.github.com/users/fowlslegs/gists{/gist_id}","starred_url":"https://api.github.com/users/fowlslegs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fowlslegs/subscriptions","organizations_url":"https://api.github.com/users/fowlslegs/orgs","repos_url":"https://api.github.com/users/fowlslegs/repos","events_url":"https://api.github.com/users/fowlslegs/events{/privacy}","received_events_url":"https://api.github.com/users/fowlslegs/received_events","type":"User","site_admin":false},"created_at":"2016-05-14T04:19:32Z","updated_at":"2016-05-14T04:19:32Z","body":"So this post was from a while ago and obviously things have changed since this was last being discussed. Whatever was the past, it makes sense now to work on making our `.deb` packages reproducible. Everything else is already deterministic in the sense that our repository contains no executable binaries. Here is Debian's guide to doing so: https://wiki.debian.org/ReproducibleBuilds/Howto. Since we have automated the process of building the packages we ship by using a 'build' VM provisioned by Ansible, it should be easy to standardize package versions for our toolchain and make the other changes necessary so that anyone can build SecureDrop packages reproducible from the comfort of their beds."}}