In response to the Snowden revelation that the CIA compromised Apple developers’ build process, thus enabling the government to insert backdoors at compile time without developers realizing, Debian, the world’s largest free software project, has embarked on a campaign to to prevent just such attacks. Debian’s solution? Reproducible builds.
In a talk at Chaos Communication Camp in Zehdenick, Germany, earlier this month (full text here), Debian developer Jérémy Bobbio, better known as Lunar, told the audience how the Linux-based operating system is working to bring reproducible builds to all of its more than 22,000 software packages.
Videos by VICE
Reproducible builds, as the name suggests, make it possible for others to reproduce the build process. “The idea is to get reasonable confidence that a given binary was indeed produced by the source,” Lunar said. “We want anyone to be able to produce identical binaries from a given source.”
“We are not discussing a hypothetical attack here.”
A software package reproducibly built should be byte for byte identical to the publicly-available package. Any difference would be evidence of tampering.
“The great thing with free software is that we have the freedom to study the source code,” he said. “That it does not contain any malware, malicious code, or security bugs.”
But how, Lunar asked, do we know that the compiled binary was built from the published source? How do we know the CIA, or other malicious attacker, has not tampered with the build process?
“We are not discussing a hypothetical attack here,” he said. “This is a real attack. We are talking about developers in totally good faith producing software, the binary they would give you, and even if they are of good faith, we could be totally owned.”
Growth in reproducibility of Debian software packages. Image: Debian
Reproducible builds are already a staple of Bitcoin and the Tor Project. Many other free software projects, including FreeBSD, NetBSD, and OpenWrt, are moving in the same direction.
“This is a bad thing for the CIA and a good thing for us,” Lunar said.
The problem of how to trust the software we use has been around since the beginning of computing, and, until recently, it was turtles all the way down. Ken Thompson’s classic “Trusting Trust” attack involves backdooring the compiler itself. Compilers compile compilers. How can you trust the compiling compiler, itself compiled by a compiler?
Reproducible builds rely in part on David A. Wheeler’s solution to this problem, Diverse Double-Compiling.
“You need two compilers,” Lunar explained, “with one that you somehow trust. Then you build the compiler under test twice, once with each compiler, and then you use the compilers that you just built to build the compiler under test again.
“If the output is the same, then no backdoors,” he added. “But for this scheme to work, you need to be able to compare that both build outputs are the same. And that’s exactly what we are enabling when having reproducible builds.”
According to Lunar, 83 percent of Debian packages are now built reproducibly, and more join the party every day.
“If we look at the code and the binary gets owned because some system somewhere has been compromised, and we don’t know about it, then we’re doomed,” Lunar told the audience.
“Reproducible builds should become the norm. Let’s make this the default for all software we produce.”
