Hacker News new | ask | show | jobs
by dgrove 1058 days ago
The lack of package signing and reproducible builds leaves a lot to be desired
5 comments

Redhat (pre-RHEL) solved package signing around 1999 with RPM 2.0/3.0 by using PGP and later replacing it with GPG. Debian solved it around 2003 by also using GPG.

https://dan.drydog.com/rpm-signing-howto.html

https://www.cryptnet.net/fdp/crypto/strong_distro.html

With truly reproducible builds, it's possible to introduce distributed caching of artifacts and selective probabilistic rebuilds from source to attest/verify integrity in a distributed manner.

Their apks aren't hosted at stable urls either so you can't even write a script that can reliably create a reproducible build.
In general:

1. There should be an easy-to-use API, CLI, library, and data (sqlite db or whatever) to query package metadata efficiently.

2. The mythological purity of rolling releases building against edge versions without dependency constraints or maintaining stable versioning causes problems in the real world(tm). There are many cases where past versions are needed. Example: ffmpeg is buggy as hell and has to be managed very carefully. Another example: binutils, gcc, mpfr, mpc, and toolchain friends have to be built together with compatible versions. Further example: don't compile anything with Clang/LLVM 14+ unless you want all of your code to break because some genius decided to break the world out of ideological perfectionism. macports, Homebrew, nix, and Arch are just some who are guilty of this sin.

Packages are signed in exactly the same way Debian packages are signed, ie the package files themselves are not signed but the index file that lists them is.
Because a single hot key for signing on a random build server has never fucked anyone before?

https://www.techtarget.com/whatis/feature/SolarWinds-hack-ex...

Please move those goalposts farther. I can still see them.
Both the package and the index is signed actually. That's why it still works when installing APK files directly
I'm confused as to why package signing isn't standard for all package managers.

Didn't Pypi just remove signing too?

PyPi did indeed, but it's a fairly interesting case. It was removed because the implementation was ineffective

More information on that here: https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI...

There was a lot of talk about why this didn't go the other way; keeping signing, but making the practice meaningful. I forget the details about that.

still true it doesn't make news I suppose