Glen Barber wrote:
In fact, Debian has been kind enough to even provide a page that shows
which parts of the FreeBSD build are non-reproducible.
https://reproducible.debian.net/freebsd/freebsd.html
This issue is one of the reasons secure sites do not use binary packages
or freebsd-update. It also illustrates problems admins have when
required to buildworld/installworld when all they should need to do is
"cd /usr/src/crypro/openssh&&make install" (for example). Does anyone
have a link to the archived discussion detailing why this functionality
was deprecated?
These are good and timely subjects given recently published details of
NSA/5 eyes methodologies as well as the issues freebsd security teams
were having as recently as a few months ago.
Roger Marquis
Refs.
https://igurublog.wordpress.com/2014/04/08/julian-assange-debian-is-owned-by-the-nsa/
http://www.linuxjournal.com/content/debian-project-aims-keep-cia-our-computers
http://www.tedunangst.com/flak/post/reproducible-builds-are-a-waste-of-time
_______________________________________________
freebsd-security@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
