Proving a timestamped hash requires producing the exact original bytes
The article questions whether developers can reproduce the exact bytes of a software release used in a timestamped hash. It demonstrates that even a rebuild from the same commit can produce different archive files due to metadata like timestamps and file order. Using deterministic build tools and specific flags can help pin these variables and achieve byte-for-byte reproducibility. The author concludes that ensuring a full pipeline reproduces identical bytes is significant work, suggesting an alternative is to timestamp a manifest of the archive's contents instead.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in