#ReproduceableBuilds

Kevin Karhan :verified:kkarhan@infosec.space
2025-12-27

@pkal @ghul there's a reason why #Linux is #GPLv2-only and not #GPLv3.

  • Mostly because GPLv3's terms are a non-starter for many things, as it's demands are just not compatible eith #patents and #copyrights that companies have to abide.

But yeah, the #SFC nowadays is quite of a net negative and it makes them and #copyleft look bad.

  • Don't even get @landley started on how "GPL enforcement" made #BusyBox look like litigatious dicks and contributed 0 lines of code back to the project.

Whilst we all would prefer #ReproduceableBuilds and fully-#OpenSource'd and #OpenHardware, beating it out of corporations in court won't be a winning strategy, and lobbying for legislation and espechally choosing repairable and open hardware will be more effective long-term…

Kevin Karhan :verified:kkarhan@infosec.space
2025-10-25

@theroyalwhee0 is there a way to let it generate reproduceable self-contained & statically linked binaries?

If so I'd consider putting it on @OS1337 's packages wishlist

#ReproduceableBuilds #OS1337

Kevin Karhan :verified:kkarhan@infosec.space
2025-10-07

@anselmschueler @renormalist @aliceif @bill88t @BrodieOnLinux @AsahiLinux +9001%

I do see a lot if mid #rewrites in #Rust just for the sake of rewriting it in Rust

  • What I do need however are #ReproduceableBuilds for @OS1337 and ideally simple & compact enough to make "#SelfHosting" not a demotivating & masochistic endeavour, so like with #C it should not require an internet connection on the build machine.

Because the final / release build may be done on a fully #airgapped system in a fukky airgapped facility that the #developers never be allowed inside or even get to know where it is and what system it powers...

  • I'm shure @landley catches my drift here...
Kevin Karhan :verified:kkarhan@infosec.space
2025-09-15

@spinglass nodds in agreement

Whilst I use #GitHub for @OS1337, I don't use #GithubActions and it can be all done completely airgapped (merely depending on your ability to get sources & toolchain on your device and follow documentation.

But then again I'm not deploying some 3rd tier esolang.

Kevin Karhan :verified:kkarhan@infosec.space
2025-09-12

@fuchsiii @GreenSkyOverMe even then I'd only believe it.if #Microsoft was forced to #OpenSource all their stuff with #ReproduceableBuilds and external independent auditors verifying it!

Kevin Karhan :verified:kkarhan@infosec.space
2025-09-11

@csgraves @OS1337 personally I'm thinking #CLI & #TUI as I want #ReproduceableBuilds and be able to at least have some Recovery System"...

Kevin Karhan :verified:kkarhan@infosec.space
2025-09-11

@krutonium @landley I mean, Ideally @OS1337 would be come a simpler and better alternative to #LinuxFromScratch or #YoctoLinux / #YoctoProject when it comes to getting started on a device.

Cuz #RaspberryPi de-facto monopolized non-#amd64 / non-#ix86 - #SBCs because they actually give a shit and publish #documentation!

  • So whilst they certainly don't support other OSes than #RaspberryPiOS, they don't just tell folks like @geerlingguy to not pester them with questions in their Forums.
Kevin Karhan :verified:kkarhan@infosec.space
2025-08-31

@sandro @OS1337 even if that mesns I'll have to setup some pipeline for #ReproduceableBuilds and packaging and I'm having a huge backlog...

Kevin Karhan :verified:kkarhan@infosec.space
2025-08-17

@UpCloud yeah, I had shit like that - alongside non-declared dependencies - and it really.manes me mandate #ReproduceableBuilds!

Kevin Karhan :verified:kkarhan@infosec.space
2025-08-13

@biglinter @snaki yes but not really...

More an exercise in #ninimalism, #FrugalComputing and #ReproduceableBuilds!

Kevin Karhan :verified:kkarhan@infosec.space
2025-05-29

@alsutton @aurynn @GrapheneOS @EUCommission @bsi I disagree.

It'll merely force them to enable aftermarket support woth an unbloated experience.

  • It won't prevent manufacturers from offering and implementing unique features in terms of hardware and software.

It'll just make them responsible to not release products like #Unihertz, #WiKo, #SOYES and many others which refuse to deliver any post-launch #updates and thus sell manufactured #eWaste.

#AOSP support and #reproduceableBuilds would at least allow #Aftermarket-#ROMs like @LineageOS to support them when the manufacturer decides not to.

  • Whether that happens is a different story, but at least #consumers wouldn't be at the mercy of a #vendor when it comes to #security!
Kevin Karhan :verified:kkarhan@infosec.space
2025-05-13

@ariadne nodds in agreement In fact I wish for rigorous demands for #ReproduceableBuilds if not #BuildFromSource like @fdroidorg / #FDroid does!

Kevin Karhan :verified:kkarhan@infosec.space
2025-05-12

@eloy @creativecommons because it being part of a #Software is different than being standalone artwork.

#NotLegalAdvice

Kevin Karhan :verified:kkarhan@infosec.space
2025-04-25

@eu_os @EC_OSPO #IMHO, it's overdue that @EUCommission & @bsi ban non-#FLOSS & #CCSS in #administration and espechally #CriticalInfrastructure.

Kevin Karhan :verified:kkarhan@infosec.space
2025-03-27

@ueeu well, @monocles do #ReproduceableBuilds as that's necessary to get their apps on @fdroidorg / #FDroid!

Kevin Karhan :verified:kkarhan@infosec.space
2025-03-25

@ueeu I think crucial parts is looking at it's components, dependencies, size and for apps permissions.

#ReproduceableBuilds for example are important, so the actually released source code is what people actually get served as basis.

Plus in terms of #security, choose *real #E2EE with #SelfCustody of all the #Keys!

Kevin Karhan :verified:kkarhan@infosec.space
2025-02-16

@centopus well, feel free to port @AsahiLinux 's patches to #C.

As for #Rust, IDGAF in general.

Kevin Karhan :verified:kkarhan@infosec.space
2025-01-12

@lispi314 @enigmatico @bunnybeam @kimapr
nodds in agreement

  • I think having a proper #API is a way to facilitate that, cuz worst-case one just slaps together some #aliases in #bash, #fish, #zsh or whatever #shell and just uses #curl to query stuff manually as this solves the whole #WebApp - issue.

And I do prefer #FLOSS as it works fine for an ever increasing audience!

  • Even if we choose to point at bad #UX / #UI combos like #GnuPG, we've to also acknowledge better existing alternatives like #enc that just work!

Personally, I think that everything people are expected to use if not forced to use should be #OpenSource as licensed in a #OSI accredited license and be released with #SourceCode and #documentation to make #reproduceableBuilds and thus facilitate #audits by truly independent parties...

  • And if that's not possible any requirement to using said things should be outlawed no matter the context!

A unsarcastically good example is #S3, even tho I hate #amazon, they wanted #developers to integrate their #ObjectStorage which necessitated an #open source'd API to the point that it's #backend is inherently reproduceable, and now every halfassing #Webhoster offers S3 #storage, sometimes with bit & second-precise billing.

Kevin Karhan :verified:kkarhan@infosec.space
2025-01-02

@dragonarchitect @Siph also just using #Rust isn't automatically make shit good.

  • And I doubt it can be as compact and efficient as #C when it comes to a minimalist #Linux distro...

But then again I care more about #ReproduceableBuilds and #Maintainablility than the languague.

Kevin Karhan :verified:kkarhan@infosec.space
2024-12-12

@ai6yr nodds in agreement whereas the "akshual coding" is "relatively simple" if one doesn't mind #readability, #maintainability or using understandable variablr names...

Testing can be automated if one builds and documebts the tests that is...

"#AI" can't do this because those #LLM|s don't learn organically but merely act as "#StochasticParrot" and not as intelligent beings that is able or even willing to transfer * exchange information freely...

Client Info

Server: https://mastodon.social
Version: 2025.07
Repository: https://github.com/cyevgeniy/lmst