@FiloSottile elsewhere / Cryptogopher / Go crypto maintainer / Professional Open Source maintainer / RC F'13, F2'17

https://mkcert.dev / https://age-encryption.org / https://filippo.io/newsletter
| https://twitter.com/FiloSottile | |
| Location | Rome 🇮🇹 |
| Pronouns | he/him |
| Website | https://filippo.io |
Good news, rclone is not backdoored! Why reproducible builds matter, and how easy they are in Go
https://blog.filippo.io/reproducing-go-binaries-byte-by-byte/
Figured it out! 🙌 And got it to reproduce 💥
The default GOROOT matters to the build ID because it's written to zversion.go, which is intentionally hashed in to detect toolchain changes.
Not, as I thought, because of the filepaths in the stdlib build IDs. The tree is recomputed with the current GOROOT instead. So every time you change GOROOT, the stdlib *is* rebuilt. (My previous tweet was wrong!)
All bets are off, it's Filippo is stupid.
But! Go binaries also get the *default* GOROOT copied in. The one that the compiler will use if no GOROOT is set, which was set at (compiler) compile time. Binaries need to know it to behave exactly like the compiler that built them.
So this is a fixed diff. But I don't see how it would affect the build ID.
Interesting read: https://github.com/golang/go/issues/17943
Three hours in. I know much more about embedded GOROOT paths.
Interestingly, the compiler will patch the paths of the symbols in the stdlib to match the GOROOT. That's smart, avoids recompiling the stdlib at every GOROOT change, but allows debuggers to find the stdlib files.
Also, should make reproducible builds just work.
So it's not this.
Trying to reproduce the release build of a popular Go software. There are Makefiles and it's pretty basic, but coming up with slight differences. Taking bets:
1/10 Backdoor
3/5 Filippo is stupid
3/10 Owner messed up
"In Praise of Drop-In Libraries"
Just today I was mentioning how SQLite (drop-in library) and youtube-dl (drop-in Python "script") are case studies in how simplicity of adoption can make the success of something (even complex).
TIL "Despite being Clang-based, Apple's compiler version numbers have no apparent relationship to Clang version numbers."