whacker
Joined 17 years ago
Karma
112
Submissions
101
Member since
Oct 22
http://hackernewsers.com/users/whacker.html
View on Hacker NewsJoined 17 years ago
I don't understand why the author thinks this is such an insurmountable issue.
Reproducible builds are possible with a little care: large parts of Debian are built reproducible. There are tools from https://reproducible-builds.org/
Bazel and similar build systems support reproducible builds, and thus identical SBOMs.
Alternatively you could create a CRI plugin that does what you want. https://github.com/kubernetes/kubernetes/blob/242a97307b3407...
Most of the 'attack' s are:
1. Plain old bugs in apt. 2. Involve disabling the very security features (GPG and checksum verification) designed to prevent that attack!