Re: maradns reproducibility fixes and the merits of picking a random number

[Julien Lepiller <julien@lepiller.eu>]

On June 7, 2022 5:24:22 AM GMT+02:00, Felix Lechner <felix.lechner@gmail.com> wrote:
>Hi,
>
>On Mon, Jun 6, 2022 at 6:50 PM Vagrant Cascadian
><vagrant@reproducible-builds.org> wrote:
>>
>> So, Debian's maradns package just removes this embedding of a "random"
>> number, and I've basically adapted their patches to build reproducibly
>> on guix too... by basically embedding the same "random" number every
>> single build!
>
>There may be more than one opinion, but as the maintainer of a TLS
>library in Debian I think it is a questionable tradeoff. At a minimum,
>it would be preferable to use the version number instead of a fixed
>constant for all releases.

Consider that even without the patch, each distro will build maradns once and distribute the package to their user. Every user gets the same binary with the same "random" number. So even if it's chosen at build time, it won't really help.

In our case, it only means users who don't use substitutes get a random number, others get the same number that the build farm picked at random. Fixing a number doesn't sound like it's gonna change a lot for these users.

>
>MaraDNS does not support DNSSEC so the program may not use entropy for
>keys. Either way, I'd rather use an unreproducible build than,
>accidentally, a known number series to encrypt secrets. Can one patch
>out the constant entirely so it is no longer available?
>
>The upstream website says: "People like MaraDNS because it’s ...
>remarkably secure." [1] Since many distributions have the same issue,
>upstream could perhaps offer the patch as a build switch to enable a
>build-time seed only when needed.

Sounds like the safest option. Maybe we could change the code that uses that number to naise an exception or abort?

>
>Thank you for your hard work on Guix! As a newbie I'll say, what a
>great distro. Thanks, everyone!
>
>Kind regards,
>Felix Lechner
>
>[1] https://maradns.samiam.org/
>