<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">Hi Holger, thanks for your answer. You brought up two important points that I hope to answer now. </div><div class="gmail_quote"><span style="line-height:1.5">One is the question on feedback, or more generally 'how will it be handled when the server reports a different hash from what the user has downloaded/build'. I agree that there should be some sort of reporting system but I'm not quite sure how this should look like. The problem is that for forensic analysis, the server would need the actual package that the client downloaded from the repo but that would eat up a lot of bandwith and storage space on the server. One idea I had was to let the client download the 'reference package' ( the source build of the server ) and then let the client create a bsdiff/courgette diff from it, which it can then upload to the server again, for further analysis. The client can then install the reference package if it wants to, and let the server ( or the operator behind it ) figure out how the packages differ.</span></div><div class="gmail_quote"><br></div><div class="gmail_quote">As for the packaging systems, dnf and apt are the systems I would like to support initially, as these are the most widespread ones. most of the client side business logic should stay in the <span style="line-height:1.5">rpfld daemon ( </span><a href="https://github.com/berndhopp/rpfl/tree/master/client/rpfld">https://github.com/berndhopp/rpfl/tree/master/client/rpfld</a><span style="line-height:1.5"> ), so I hope that the plugins can stay lean. </span></div><div class="gmail_quote"><span style="line-height:1.5"><br></span></div><div class="gmail_quote"><span style="line-height:1.5">best,</span></div><div class="gmail_quote"><span style="line-height:1.5">Bernd </span></div><div class="gmail_quote"><span style="line-height:1.5"> </span></div><div class="gmail_quote">On Wed, Jun 1, 2016 at 4:08 PM, Holger Levsen <span dir="ltr"><<a href="mailto:holger@layer-acht.org" target="_blank">holger@layer-acht.org</a>></span> wrote:<br></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Bernd,<br>
<br>
thanks for reaching out to us!<br>
<span><br>
On Tue, May 31, 2016 at 09:45:11AM +0000, Bernd Hopp wrote:<br>
> I'm looking for developers and build experts to join my project for<br>
> distributed package verification rpfl (github<br>
</span>> <<a href="https://github.com/berndhopp/rpfl" rel="noreferrer" target="_blank">https://github.com/berndhopp/rpfl</a>>) and would like to ask you to give me a<br>
<span>> hand at this. Goal of the project is to give package management systems the<br>
> opportunity to verify that a downloaded package corresponds to its publicly<br>
> available source code.<br>
<br>
</span>very nice!</blockquote></div></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span><br>
> To achieve this, a server will create hashes of the<br>
> packages that it had previously build from source and sign them via<br>
> ed25519; this signature is then be used by the client to check if the<br>
> downloaded package is the same as the package resulting from a build from<br>
> source.<br>
<br>
</span></blockquote></div></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I think it would also be good if the server could get these hashes from<br>
other builders (just different machines or entirely operating by<br>
different entities) and it should be possible to store several different<br>
hashes for a given source. Because unreproducible software exists today.<br>
<br>
Another idea, for the Debian usecase, is also to have several people<br>
report the checksums they see, so that it becomes possible to see<br>
if+when one gets a different checksum than everybody else </blockquote></div></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> </blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>
> The project is currently proof-of-concept and needs some work at the server</span></blockquote></div></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span><br>
> code, especially in the area of buildsystem-integration. Also, plugins fro<br>
> package management systems need to be developed to really make use of it.<br>
<br>
</span></blockquote></div></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">What system are you targeting at the moment, btw? IOW: do you have plans<br>
for integration with apt or dnf or $anyothertool?<br>
<span><br>
> If you are interested in participating or if you know somebody who might<br>
> be, please don't hesitate to ask me any questions about the project or<br>
> next steps.<br>
<br>
</span>please continue sharing news about this project on this list! also, you<br>
might want to join #reproducible-builds on <a href="http://irc.oftc.net" rel="noreferrer" target="_blank">irc.oftc.net</a> if you are on<br>
IRC…<br>
<span><font color="#888888"><br>
<br>
--<br>
cheers,<br>
Holger<br>
</font></span><br>_______________________________________________<br>
<a href="mailto:rb-general@lists.reproducible-builds.org" target="_blank">rb-general@lists.reproducible-builds.org</a> mailing list<br>
<br>
To change your subscription options, visit <a href="https://lists.reproducible-builds.org/listinfo/rb-general" rel="noreferrer" target="_blank">https://lists.reproducible-builds.org/listinfo/rb-general</a>.<br>
<br>
To unsubscribe, send an email to <a href="mailto:rb-general-unsubscribe@lists.reproducible-builds.org" target="_blank">rb-general-unsubscribe@lists.reproducible-builds.org</a>.<br></blockquote></div></div></div></div>