search

sekey / sekey

Use Touch ID / Secure Enclave for SSH Authentication!
MIT License
2.46k stars 79 forks source link

Deterministic builds #22

Open InnovativeInventor opened 6 years ago

InnovativeInventor commented 6 years ago

Great project @ntrippar!

I was thinking that since this all comes precompiled, it would be nice if something like Gitian was used to have deterministic builds. That way, observers can verify that the packages on GitHub have not been tampered with.

Edit: The SHA512 hash of your sekey file in the zip that you released is: 648449f6bd2010c25e79021b2d963238186ed6abc85919b2124332f6b0de9a724e08066d61526361d7c741d104257093e19d91a4fd577e829442b5f3769d7ede

And the SHA512 hash that I arrived at is: cd667ce859a637439ae3744de98917a68658c191641872b616f2d4d7d2be88f697cfd95792c6d42398b29c99740a9cd6515eba9e117fb05a7f054767ce52a270

Clearly, the current process of building in rust is not deterministic.

ntrippar commented 6 years ago

Hi, doing a repro builds is a great idea. I should sign the final one. I will check tomorrow Gitian.

ntrippar commented 6 years ago

@InnovativeInventor we will have two issues here, we link with some apple libraries, for that i suppose we need to build it on OSX. i will check if there any deterministic build system for OSX stuff. I didn't check it yet if i can have a OSX vm for doing it. on the documentation i only see linux references.

This should be top priority, also Im working on a v2 release with a lot of fixes, need to push the code

ntrippar commented 5 years ago

this will be released really soon, so rust support for deterministic builds, but we need the Cargo.lock uploaded here. Im currently in the process of rabase some code, this will be push for end of this week