Re: maradns reproducibility fixes and the merits of picking a random number

[Ludovic Courtès]

Hi,

Vagrant Cascadian <vagrant@reproducible-builds.org> skribis:

> But there's one nervous-making issue this revealed; maradns embeds a
> random number at build time ... allegedly for systems that don't have
> /dev/urandom... see
> maradns-3.5.0020/deadwood-3.5.0020/src/Makefile.ubuntu2004:
>
>   # Since some systems may not have /dev/urandom (Windows, *cough* *cough*), 
> we
>   # keep a randomly generated prime around
>
> So it's got some code to generate a random number at build time and
> embed it in the binary. Now, if there's anything I know about good
> practices about random numbers, this sort of thing is generally a very
> large red flag! It also makes the package build differently every time!

Woow.  Reproducibility work lets you uncover issues you wouldn’t think of!

Ludo’.