Re: [rtcweb] Hermetic builds (Re: Cisco to open source its H.264 implementation and absorb MPEG-LA licensing fees)

[Bjoern Hoehrmann <[e-mail]>]

* Harald Alvestrand wrote:
>On 12/13/2013 04:33 AM, Mo Zanaty (mzanaty) wrote:
>> Yes, Cisco and Mozilla plan on solving fully reproducible binaries for all
>> targets officially supported in the openh264 project. Nothing less would
>> be acceptable to the community, especially given the recent security
>> incidents.

>Since this is a subthread with technical content, I'd like it to have 
>its own header....
>
>the name I've heard for this kind of generation environments is 
>"hermetic build".
>Google's been trying for hermetic builds for NaCL for instance - see 
>this doc:
>http://www.chromium.org/nativeclient/design-documents/building-a-hermetic-toolchain-on-cygwin

That seems to be a different concept, specifically

  Definition: the Native Client toolchain is said to be hermetic iff
  it can be copied to any location in the directory tree and it does
  not require system-wide installation of other 3-rd party tools.

which is more like http://en.wikipedia.org/wiki/XCOPY_deployment

  XCOPY deployment or xcopy installation is a software application's
  installation into a Microsoft Windows system simply by copying files.

Goals of these include being able to have multiple independent versions
of an application installed on a single system e.g. for testing purposes
and being able to put an application on a USB drive and run it from
there without any need to install or uninstall the software.

The goal of "reproducible binaries" is verification.

As an example, a binary might contain absolute paths to where the debug
symbol files have been generated during compilation. This path would be
specific to the build environment and would make the binaries less "re-
producible". But there is no real runtime dependency on such paths, so
it does not interfere with "XCOPY deployment".

>The bootable image of the build environment may be the simplest way....

The idea is to avoid trusting binary blobs, so one binary blob producing
another binary blob is not really interesting. Of course, explaining how
to create an equivalent bootable image (install Debian vX.Y with default
options, apt-get build tools, wget source code, untar, configure, make)
can avoid many problems.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/