• 1 Post
  • 20 Comments
Joined 1 year ago
cake
Cake day: July 29th, 2023

help-circle
  • But then there is also the question if you trust github (and because of that microsoft, but also the USA because of laws) with always building from the sources, and adding nothing more.

    Yesterday I would have said ‘blah, they would not care about my particular small project’. But since then I read the paper recommended by a user in this post about building a compromised compiler that would installs a back-door to a type of login field. I now think it is not so crazy to think that intelligence agencies might collude with Microsoft to insert specific back-doors that somehow allows them to break privacy-related protocols or even recover private keys. Many of these might rely on a specific fundamental principle and so this could be recognized and exploited by a compiler. I came here for a practical answer to a simple practical situation, but I have learned a lot extra 😁


  • No, I’m not concerned about a lawsuit. It’s something that I want to do because I think that it is important. If I want to share tools with non-tech savvy people who are unable to build them from source, I want to be able to share these without anyone needing to “trust” me. The reproducible builds standards are a very nice idea, and I will learn how to implement them.

    But I still wonder whether my approach is valid or not - is printing the hash of the output executable during Github’s build process, such that it is visible in the workflow logs, very strong evidence that the executable in the release with the same hash was built by github through the transparent build process? Or is there a way a regular user would be able to fake these logs?






  • Thanks. In the future I work using the Reproducible Builds practices and use OpenBSD to sign my builds.

    In the immediate situation I want to know whether there is a way to use GitHub as my trusted third-party builder. I would like to share something with people - some of who might not have the skills to replicate the build themselves, but I still would like to be able to point them to something that is easy to understand and give them argument.

    My current argument is: “See, in the github logs you can see that github generated that hash internally during the workflow, and it matches the hash of the file that you have downloaded. So this way you can be sure that this build really comes from this source code, which was only changed here and there”. Of course I need to make absolutely sure that my argument is solid. I know that I’m not being malicious, but I don’t want to give them an argument of trust and then find out that I have mislead them about the argument, and that it was in fact possible to fake this.


  • I think you can even upload release files manually, independently of if you use actions or not, so it can never be guaranteed that it was built from the sources.

    True, but that’s why my current idea is the following:

    As part of the wortkflow, GitHub will build the executable, compute a few different hashes (sha256sum, md5, etc…), and those hashes will be printed out in the GitHub logs. In that same workflow, GitHub will upload the files directly to the release.

    So, if someone downloads the executable, they can compute the sha256sum and check that it matches the sha256 that was computed by github during the action.

    Is this enough to prove that executable they are downloading the same executable that GitHub built during that workflow? Since a workflow is associated a specific push, it is possible to check the source code that was used for that workflow.

    In this case, I think that the only one with the authority to fake the logs or mess with the source during the build process would be GitHub, and it would be really hard for them to do it because they would need to prepare in advance specifically for me. Once the workflow goes through, I can save the hashes too and after that both GitHub and I would need to conspire to trick the users.

    So, I am trying to understand whether my idea is flawed and there is a way to fake the hashes in the logs, or if I am over-complicating things and there is already a mechanism in place to guarantee a build.








  • Max@nano.gardentoChat@beehaw.orgHow's your week going?
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago

    PhD thesis! 😅

    Gluing my ass to the chair won’t be sufficient. I think I have some form of computer distraction addiction or undiagnosed ADHD, because when I am sitting at the computer I find it really hard to do what I need to do. I am able to find a universe of distractions by slightly moving my fingers, and I have an inordinate ability to psychologically (not rationally!!!) justify it as being somewhat useful. The only thing that saves me is that I can be very efficient when I do focus, but this has become more difficult as the complexity of the work increases, and so many different figures, tables, and concepts have to coalesce together to tell a story that I genuinely believe…

    I would probably have a better chance trying to write with pencil and paper in an isolated island than with LaTeX in my computer…






  • Max@nano.gardentoChat@beehaw.orgHow's your week going?
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    Some virus managed to wreck inflammatory havoc around some of my nerves and the right side of my head has been numb since Thursday, my ear in pain, and a zoo of sporadic symptoms come and go 😅 So I have been in the computer a lot. I’ve been working on setting up a lemmy instance and I also played in the canvas.

    As for the rest of the week… I have been procrastinating on thesis writing, and I need to be done before September, so I am trying to find a source of will-power to force myself to write. But this infection is not helping me 😬