Re: [rtcweb] Hermetic builds (Re: Cisco to open source its H.264 implementation and absorb MPEG-LA licensing fees)

[Randell Jesup <[e-mail]>]

On 12/16/2013 10:12 AM, Harald Alvestrand wrote:
> Since this is a subthread with technical content, I'd like it to have 
> its own header....
>
> the name I've heard for this kind of generation environments is 
> "hermetic build".
> Google's been trying for hermetic builds for NaCL for instance - see 
> this doc:
> http://www.chromium.org/nativeclient/design-documents/building-a-hermetic-toolchain-on-cygwin
>
>
> On 12/13/2013 04:33 AM, Mo Zanaty (mzanaty) wrote:
>> Yes, Cisco and Mozilla plan on solving fully reproducible binaries for all
>> targets officially supported in the openh264 project. Nothing less would
>> be acceptable to the community, especially given the recent security
>> incidents.
>>
>> We welcome contributions from anyone who has struggled with this in the
>> past, and is aware of specific problems or solutions beyond the obvious
>> ones below.
>>
>> 1. Identical source trees (git hash)
>> 2. Identical project configuration (make targets that include all
>> configuration options)
>> 3. Identical tool chains on similar build machines (same arch at least,
>> probably x86-64)
>> 4. Deterministic tool chains (avoid tool options that lack determinism)
>> 5. Deterministically identical tool chain output must be hashed separately
>> from uniquely generated data (build info, etc.)
>>
>> Some feel that tool chains can also be subverted and therefore should also
>> be built from source, using some root golden tool chain. We are not that
>> paranoid yet. Should we be?

#include <classic_unix_getty_backdoor.h>

Tool chains absolutely can be subverted, to the point where even 
rebuilding them using themselves from 'clean' source leaves them subverted.

Super-widely-distributed binaries (like this would be) are obvious 
targets for such things (as are browsers like Chrome and Firefox - but 
those have some extra safety due to build built across a wide range of 
toolchains - but even that leaves the official binaries at risk in theory).

At some point, you have to decide if hand-assembling code with a hex 
editor is worth it (and do you *trust* your hex editor?)
;-)  And don't forget, the backdoor code-flip could be in the filesystem 
too!  With some serious hackery, even in the HD (stretching, but 
theoretically possible I believe).

If you don't want to go that far down, you need to decide to trust 
*some* basic toolchain, use it to build the "current" toolchain, and use 
that to build the binaries.  You can help yourselves by choosing a base 
toolchain that predates anyone knowing you're going to use it for this 
project.  (Note: base toolchain includes the base OS...)

-- 
Randell Jesup -- rjesup a t mozilla d o t com