-
Notifications
You must be signed in to change notification settings - Fork 52
Open
Description
hi again!
I noticed this crate enables the compile-time-rng feature on the ahash crate. For build-your-own-binaries this is fine, but when building binaries for distributions we have two problems:
- There's independent verification build servers related to the Reproducible Builds project. They help detect build server compromises, this only works of the build is deterministic though. Reading from a random number generator breaks this however.
- Since our binaries in Arch Linux/Debian are public, this also means our
ahash::RandomState::defaultis publicly known, defeating the Hash Collision DoS this was likely meant to prevent.
For Debian we can patch this out of the crate, for systems like Arch Linux we use crates as-is from crates.io, meaning there's currently no way to get deterministic binaries unfortunately.
Would you mind removing this, or make it optional?
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels