Here is my monthly update covering what I have been doing in the free software world during January 2021 (previous month):
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
This month, I:
Categorised a huge number of packages and issues in the Reproducible Builds “notes” repository.
Drafted, published and publicised our monthly report and attended a number of IRC meetings.
Submitted the following patches to fix reproducibility-related toolchain issues within Debian:
I also submitted a number of patches to fix specific reproducibility issues including apertium-anaphora & davs2, as well as a number of issues found during reproducibility testing. For example, I discovered that
node-tap-parser‘s manual pages contained errors instead of documentation (#980293).
disorderfs is our FUSE-based filesystem that deliberately introduces non-determinism into system calls to reliably flush out reproducibility issues. This month, I updated our benchmarking tools to call use a tool that will call
stat(2) repeatedly. […]
Updated the main Reproducible Builds website and documentation with many changes, including adding a missing image […] and to ignore commits that start with, for example, ‘
2020 12‘ when generating commit listings […].
strip-nondeterminism is our tool to remove specific non-deterministic results from a completed build. This month, ensured that the tool did not process unwritable files and printing a warning in this case (#980356) as well as a number of codebase improvements such as reflowing logic to make future changes easier. […]
I also made the following changes to diffoscope, our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues, releasing version 164, version 165 and version 166 as well as triaging and merging many contributions from others:
Frontdesk duties, responding to user/developer questions, reviewing others’ packages, participating in mailing list discussions, attending a monthly meeting, etc.
Issued DLA 2515-1 for
csync2. The cluster synchronization tool did not correctly check for the return value from GnuTLS security routines; it neglected to repeatedly call this function as required by the design of the API.
Issued DLA 2516-1 for
gssproxy to fix a privilege separation issue that arose from failing to unlock a shared resource.
Issued DLA 2517-1 and ELA 342-1 for the Dovecot to fix two issues. The first was an issue where an attacker could cause the IMAP server to discover filesystem directory structures and even access other users’ emails using a specially crafted command (
CVE-2020-24386). The second was an issue where a malicious sender could crash Dovecot by sending messages with more than 10,000 (!) attachments (
It was discovered that there was an in issue in the command-line tool for the Pacemaker High Availability stack. Local attackers were able to execute commands via shell code injection to the
crm history command-line tool, potentially allowing escalation of privileges. DLA 2533-1 was issued to address this.
You can find out more about the project via the following video:
This content was originally published here.