[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #3688 [Tor bundles/installation]: Deterministic builds for Linux and Mac OS
#3688: Deterministic builds for Linux and Mac OS
--------------------------------------+-------------------------------------
Reporter: mikeperry | Owner: erinn
Type: enhancement | Status: new
Priority: major | Milestone:
Component: Tor bundles/installation | Version:
Keywords: | Parent:
Points: | Actualpoints:
--------------------------------------+-------------------------------------
To ensure integrity against build machine compromise, we should be able to
produce identical binaries on two different identically configured
machines and verify that hash is the same for each. Right now, this is not
possible, primarily because of two things:
1. gcc uses entropy for symbol mangling
2. The linker inserts timestamps into libraries, especially static ones.
Issue 1 can be solved by giving gcc a specific seed in our makefiles
(-frandom-seed=string). If we have no collisions, we can get away with
giving the same seed to every gcc invocation.
Issue 2 can be solved for static libraries by passing the -D option to
'ar'. It is unclear if shared libraries can be produced in this way, or if
this option is not needed for shared libraries.
On Windows, the problem remains entirely unsolved:
http://stackoverflow.com/questions/1180852/deterministic-builds-under-
windows
However, if we can do this for Linux and Mac OS using the same build
flags, that would still be worth it.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3688>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs