Path: csiph.com!eternal-september.org!feeder.eternal-september.org!nntp.eternal-september.org!.POSTED!not-for-mail From: Kragen Javier Sitaker Newsgroups: comp.lang.forth Subject: GForth reproducible builds (was Re: Back to the Forth Virus) Date: Wed, 02 Sep 2026 14:40:07 -0300 Organization: Primarily biological and memetic Lines: 21 Message-ID: <87jyp37ds8.fsf_-_@debian> References: <11069n1$3617t$1@dont-email.me> <1106c8c$37c1i$1@dont-email.me> <87bjdl2nt2.fsf@lispclub.com> <2026Jun8.174027@mips.complang.tuwien.ac.at> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Injection-Date: Wed, 02 Sep 2026 17:42:23 +0000 (UTC) Injection-Info: dont-email.me; logging-data="3172939"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19O9iJ7Y+1LyoNwaK8/atXm"; posting-host="de81ddf0846fce2f7070364d1569cfb9" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) Cancel-Lock: sha1:KeY3gaEvPN4q8CVCOG59JBEwRbI= sha1:6vYzGsIxETq8YLpjezhszYmN9mc= sha256:RTpMpwTJE/fCcDbqHwn+ISn2hCf59E9yEU1MAKTzFzo= sha1:cplBI7o5vUpn9bD2hdt9n/Vem1I= sha256:25+4Y5iM9z9AAT+r5WKSYLEXmEa9tkNCpnobCGy32cA= Xref: csiph.com comp.lang.forth:135532 anton@mips.complang.tuwien.ac.at (Anton Ertl) writes: > you get the snapshot from > , which is > secured with https, and the signature comes from > , also secured with https, so an attack > scenario that subverts all that is interesting. The easiest way > probably would be to break into Bernd Paysan's computer where he > builds and signs Gforth, but then a trusted signature does not help. Generally speaking, so-called “reproducible builds” are a potential solution to this problem — they do not prevent back doors from being introduced into the source code, but if there is no back door in the source code, they will detect any attempt to introduce back doors into the executable code, because builds on different machines will not match byte-for-byte. (Unless all of the build machines have been subverted by the same attacker.) Debian is currently succeeding in building GForth 0.7.3 reproducibly: Kragen