Reproducible builds on PyPI: what's missing
What's missing to have reproducible builds on PyPI
Reproducible builds could let third parties verify that PyPI distributions match their source code, catching tampering like the SolarWinds attack. But current specs lack a way to record the source location and build tools for sdists and wheels. The author proposes recording this info in metadata, using SBOMs for wheels, and a new sdist format, with build backends automatically logging their environment. Trusted verifiers could then confirm reproducibility on PyPI, giving users confidence without extra work for producers.
If we were to record the same information in sdists and wheels (such as in the metadata), then we would know the location of the source code used to make the distribution.
- edelbitter
> this file was independently reproduced by <name of trusted party>
Sounds risky, unless paired with strong policy about what a verifier should do.
e.g. if the verifier just grants network access to the buildbot that then checks what the result should look like, then compromise could remain invisible while the label silently downgrade to "independently downloaded by".
And I do not expect there are many parties that would be willing to provide such service beyond their own needs, while simultaneously not already providing that service in places where the infrastructure and policies are already set (such as Debian). Or at least they would already contribute towards build dependencies that do not break reproducibility on every other version bump.
- whateverboat
For python, it seems very difficult to actually do reproducible builds in a way that is useful, because python wheels have very implicit assumptions about paths and environemtns that do not happen anywhere else.
- crabbone
These people are so far gone in their fantasy land...
> So we either have to shrug and say, "don't use sdists if you want reproducible builds,"
What is this, I can't even... How can anyone expect to have a reproducible build's artifact if they downloaded the source?
Now, and most importantly, all this talk is about "pure" (as in Python-only) packages. This is, practically, worthless for most real Python projects because those rely on native bindings. Why should anyone expect PyPI to be able to build those if no standard procedure exists for building them is beyond comprehension.