Re: Debian python package bytecode compatibility

From	Colin Watson <cjwatson@debian.org>
Newsgroups	linux.debian.project
Subject	Re: Debian python package bytecode compatibility
Date	2021-09-29 22:30 +0200
Message-ID	<D2Onf-6KE-9@gated-at.bofh.it> (permalink)
References	<D2n3H-6V7-9@gated-at.bofh.it> <D2D8u-8kV-5@gated-at.bofh.it> <D2HYt-2Qw-9@gated-at.bofh.it> <D2MY9-5Mf-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Sep 29, 2021 at 12:42:56PM -0600, Sam Hartman wrote:
> There's a chain of signatures for the installed files, and so you could
> presumably validate that the installed files have not been modified.
> That is much more challenging for files generated from the postinst.

I wondered about reproducibility of Python bytecode, and from a quick
web-search before the children's bedtime I ran across a couple of links
that look interesting to pursue:

  https://bugs.python.org/issue29708
  https://vulns.xyz/2021/08/reproducible-python-bytecode/

I couldn't find anything under Debian's reproducible builds banner (it
is after all slightly outside the usual area of building reproducible
.debs), but maybe I missed something.

-- 
Colin Watson (he/him)                              [cjwatson@debian.org]

Back to linux.debian.project | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Debian python package bytecode compatibility Manoj Singh <rosesingh123@gmail.com> - 2021-09-28 17:20 +0200
  Re: Debian python package bytecode compatibility Sam Hartman <hartmans@debian.org> - 2021-09-28 21:30 +0200
  Re: Debian python package bytecode compatibility Bastian Blank <waldi@debian.org> - 2021-09-29 10:30 +0200
    Re: Debian python package bytecode compatibility Paul Wise <pabs@debian.org> - 2021-09-29 15:40 +0200
      Re: Debian python package bytecode compatibility Sam Hartman <hartmans@debian.org> - 2021-09-29 21:10 +0200
        Re: Debian python package bytecode compatibility Colin Watson <cjwatson@debian.org> - 2021-09-29 22:30 +0200

csiph-web