Date: Fri, 18 Sep 2015 07:07:59 -0700 (PDT) From: Roger Marquis <marquis@roble.com> To: freebsd-security@freebsd.org Cc: freebsd-questions@freebsd.org Subject: Re: HTTPS on freebsd.org, git, reproducible builds In-Reply-To: <20150918134659.GB28949@FreeBSD.org> References: <CAD2Ti2_YNkNi2b=PzFCwu3PVaP8hOzADys3=-k0AqvsDRhJpzA@mail.gmail.com> <86vbb7dhaa.fsf@nine.des.no> <20150918134659.GB28949@FreeBSD.org>
| previous in thread | raw e-mail | index | archive | help
Glen Barber wrote: > In fact, Debian has been kind enough to even provide a page that shows > which parts of the FreeBSD build are non-reproducible. > > https://reproducible.debian.net/freebsd/freebsd.html This issue is one of the reasons secure sites do not use binary packages or freebsd-update. It also illustrates problems admins have when required to buildworld/installworld when all they should need to do is "cd /usr/src/crypro/openssh&&make install" (for example). Does anyone have a link to the archived discussion detailing why this functionality was deprecated? These are good and timely subjects given recently published details of NSA/5 eyes methodologies as well as the issues freebsd security teams were having as recently as a few months ago. Roger Marquis Refs. https://igurublog.wordpress.com/2014/04/08/julian-assange-debian-is-owned-by-the-nsa/ http://www.linuxjournal.com/content/debian-project-aims-keep-cia-our-computers http://www.tedunangst.com/flak/post/reproducible-builds-are-a-waste-of-time
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?>