[Git][reproducible-builds/reproducible-website][master] gothenburg: Add d1-badbuilds.md

[Bernhard M. Wiedemann (@bmwiedemann-guest)]

Bernhard M. Wiedemann pushed to branch master at Reproducible Builds / reproducible-website


Commits:
c4ed760b by Bernhard M. Wiedemann at 2026-09-24T17:48:01+02:00
gothenburg: Add d1-badbuilds.md

- - - - -


1 changed file:

- + _events/gothenburg2026/agenda/d1-badbuild.md


Changes:

=====================================
_events/gothenburg2026/agenda/d1-badbuild.md
=====================================
@@ -0,0 +1,32 @@
+Greg's work: uses stabilizer (these stabilizers guarantee removing non-malicious differences)  
+  
+Signal APK: some part was ignored.  
+  
+sbuild does network isolation for rebuilding  
+  
+GitHub Runner differences were due to build cache  
+  
+unintentional bad  
+- usually harmless  
+- detecting causes  
+- this is 90%  
+  
+intentional bad  
+- malware/exploits  
+- detecting would be good publicity  
+  
+diffoscope feature request:  
+
+   - show files only present once
+   - --new-file
+
+  
+enumerate possible places of shipping bad stuff not present in the source code  
+1. small changes in logic in the binary  
+2. new functionality in the binary  
+3. installation hooks  
+4. additional files (e.g. in PATH)  
+5. metadata of the path (e.g. new dependency)  
+  
+  
+Case in F-Droid, Nextcloud News, someone put a package in a Maven repository with a same namespace as the app was using. F-Droid builds from a clean machine, pulling the malicious dependency. The developer has a cache so they weren't affected. Potentially a targeted attack. This wasn't detected.



View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/c4ed760bfd69aa4b9ac258d4a7825b8d9101a2dd

-- 
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/c4ed760bfd69aa4b9ac258d4a7825b8d9101a2dd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20260924/f8251fd9/attachment.htm>