Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.forth > #135532

GForth reproducible builds (was Re: Back to the Forth Virus)

From Kragen Javier Sitaker <kragen@canonical.org>
Newsgroups comp.lang.forth
Subject GForth reproducible builds (was Re: Back to the Forth Virus)
Date 2026-09-02 14:40 -0300
Organization Primarily biological and memetic
Message-ID <87jyp37ds8.fsf_-_@debian> (permalink)
References <11069n1$3617t$1@dont-email.me> <1106c8c$37c1i$1@dont-email.me> <87bjdl2nt2.fsf@lispclub.com> <2026Jun8.174027@mips.complang.tuwien.ac.at>

Show all headers | View raw

anton@mips.complang.tuwien.ac.at (Anton Ertl) writes:
> you get the snapshot from
> <https://www.complang.tuwien.ac.at/forth/gforth/Snapshots/>, which is
> secured with https, and the signature comes from
> <https://savannah.gnu.org/>, also secured with https, so an attack
> scenario that subverts all that is interesting.  The easiest way
> probably would be to break into Bernd Paysan's computer where he
> builds and signs Gforth, but then a trusted signature does not help.

Generally speaking, so-called “reproducible builds” are a potential
solution to this problem — they do not prevent back doors from being
introduced into the source code, but if there is no back door in the
source code, they will detect any attempt to introduce back doors into
the executable code, because builds on different machines will not match
byte-for-byte.  (Unless all of the build machines have been subverted by
the same attacker.)

Debian is currently succeeding in building GForth 0.7.3 reproducibly:
<https://reproduce.debian.net/amd64/forky.html#gforth>

Kragen

Back to comp.lang.forth | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Back to the Forth Virus clv2020 <clv2020@vodafonemail.de> - 2026-06-08 13:40 +0200
  Re: Back to the Forth Virus Jan Coombs <jan4etsept@murray-microft.co.uk> - 2026-06-08 13:16 +0100
  Re: Back to the Forth Virus Ruvim <ruvim.pinka@gmail.com> - 2026-06-08 12:23 +0000
    Re: Back to the Forth Virus Daniel Cerqueira <dan.list@lispclub.com> - 2026-06-08 13:56 +0100
      Re: Back to the Forth Virus anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2026-06-08 15:40 +0000
        Re: Back to the Forth Virus Daniel Cerqueira <dan.list@lispclub.com> - 2026-06-08 19:26 +0100
          Re: Back to the Forth Virus anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2026-06-08 20:06 +0000
        GForth reproducible builds (was Re: Back to the Forth Virus) Kragen Javier Sitaker <kragen@canonical.org> - 2026-09-02 14:40 -0300
  Re: Back to the Forth Virus minforth <minforth@gmx.net> - 2026-06-09 01:01 +0200
    Re: Back to the Forth Virus clv2020 <clv2020@vodafonemail.de> - 2026-06-10 13:13 +0200
      Re: Back to the Forth Virus minforth <minforth@gmx.net> - 2026-06-11 10:01 +0200
        Re: Back to the Forth Virus anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2026-06-11 17:28 +0000
          Naming issues in create-does (was: Back to the Forth Virus) Ruvim <ruvim.pinka@gmail.com> - 2026-06-12 17:23 +0000
            Re: Naming issues in create-does (was: Back to the Forth Virus) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2026-06-12 17:52 +0000
              Re: Naming issues in create-does (was: Back to the Forth Virus) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2026-06-12 18:22 +0000
                Re: Naming issues in create-does dxf <dxforth@gmail.com> - 2026-06-13 13:14 +1000
                Re: Naming issues in create-does Ruvim <ruvim.pinka@gmail.com> - 2026-06-13 06:33 +0000
                Re: Naming issues in create-does dxf <dxforth@gmail.com> - 2026-06-13 22:20 +1000
                Re: Naming issues in create-does Ruvim <ruvim.pinka@gmail.com> - 2026-06-13 15:55 +0000
                Re: Naming issues in create-does Ruvim <ruvim.pinka@gmail.com> - 2026-06-15 13:08 +0000
                Re: Naming issues in create-does Hans Bezemer <the.beez.speaks@gmail.com> - 2026-07-23 19:58 +0200
                Defining words in more than one step (was: Naming issues in create-does) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2026-06-13 06:46 +0000
                Re: Defining words in more than one step dxf <dxforth@gmail.com> - 2026-06-14 12:29 +1000
              Re: Naming issues in create-does Ruvim <ruvim.pinka@gmail.com> - 2026-06-12 19:59 +0000
                Re: Naming issues in create-does anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2026-06-13 10:25 +0000
                Re: Naming issues in create-does Ruvim <ruvim.pinka@gmail.com> - 2026-06-13 15:30 +0000
                Re: Naming issues in create-does anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2026-06-13 17:30 +0000
              Re: Naming issues in create-does (was: Back to the Forth Virus) peter <peter.noreply@tin.it> - 2026-06-13 20:21 +0200
  Re: Back to the Forth Virus dxf <dxforth@gmail.com> - 2026-06-09 12:14 +1000
    Re: Back to the Forth Virus "Kerr-Mudd, John" <admin@127.0.0.1> - 2026-06-10 18:54 +0100
      Re: Back to the Forth Virus dxf <dxforth@gmail.com> - 2026-06-11 16:32 +1000
        Re: Back to the Forth Virus "Kerr-Mudd, John" <admin@127.0.0.1> - 2026-06-11 14:20 +0100
  Re: Back to the Forth Virus Stephen Pelc <stephen@vfxforth.com> - 2026-06-09 10:22 +0000
    Re: Back to the Forth Virus clv2020 <clv2020@vodafonemail.de> - 2026-06-10 15:55 +0200
  Re: Back to the Forth Virus albert@SPENARNC.XS4ALL.NL - 2026-07-24 13:35 +0200

csiph-web