kpcyrd 8 hours ago

> Even when source is available, as in open source operating systems like Linux, approximately no one checks that the distributed binaries match the source code.

This was not the case in 2023 for Arch Linux[1] back when the post was originally published, and is also not the case for Debian[2] since 2024.

[1]: https://reproducible.archlinux.org/

[2]: https://reproduce.debian.net/

lrvick 6 hours ago

My team and I built stagex as the first software build toolchain that internally mandates 100% determinism and full source bootstrapping. It is explicitly designed for supply chain security to trust no single human or computer.

Also container native and soon to be LLVM native.

It is our best answer so far to the ROTT paper.

https://codeberg.org/stagex/stagex

  • pabs3 2 hours ago

    See also the Bootstrappable Builds website/community.

    https://bootstrappable.org/

    • lrvick an hour ago

      Also the wider reproducible builds website/community https://reproducible-builds.org/

      Also live-bootstrap, stage0, mrustc, mes, and so many amazing projects whose combined efforts all helped finally make probably trustworthy toolchains a thing.

      • pabs3 33 minutes ago

        Very few OS distros have adopted Bootstrappable Builds unfortunately.

riemannzeta 10 hours ago

Reflections on Trusting "Reflections on Trusting Trust"?

Y_Y 9 hours ago

Would be fun to see if an llm could produce this (assuming tfa and other solutions weren't present in the training data).