Skip to content

Reproducible Builds: Dropping ahash/compile-time-rng #135

@kpcyrd

Description

@kpcyrd

hi again!

I noticed this crate enables the compile-time-rng feature on the ahash crate. For build-your-own-binaries this is fine, but when building binaries for distributions we have two problems:

  • There's independent verification build servers related to the Reproducible Builds project. They help detect build server compromises, this only works of the build is deterministic though. Reading from a random number generator breaks this however.
  • Since our binaries in Arch Linux/Debian are public, this also means our ahash::RandomState::default is publicly known, defeating the Hash Collision DoS this was likely meant to prevent.

For Debian we can patch this out of the crate, for systems like Arch Linux we use crates as-is from crates.io, meaning there's currently no way to get deterministic binaries unfortunately.

Would you mind removing this, or make it optional?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions