1036178 - Use Deterministic Builds for Firefox

Status: RESOLVED DUPLICATE of bug 885777

(Firefox :: Untriaged, defect)

Description

[dp]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20100101

Steps to reproduce:

I wish Firefox (and all the software Mozilla builds) would switch to a deterministic build system, in order to allow a control of the distributed binaries.
I am aware this means a great effort by the Firefox team, but I think it is truly necessary.

It would allow what Brendan Eich requested in Trust But Verify:

"establish automated systems to verify official Mozilla builds from source; and
raise an alert if the verified bits differ from official bits."
https://brendaneich.com/2014/01/trust-but-verify/

Two blog posts by Mike Perry of the Tor Project about deterministic builds were published here: https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise
https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details

Also, the switch would mean better efficiency in testing,according to what written about Cromium: http://www.chromium.org/developers/testing/isolated-testing/deterministic-builds

Comment 1

[Justin Dolske [:Dolske]]

Note that Brendan's post even linked to bug 885777.

Comment 2

[dp]

 Oh, thanks Justin. In fact I read the blog post long ago (when it was published) and recently came back to my mind, so I filed a bug without rereading it.

Thanks for the triage Justin and sorry for the noise.

Looks like this task isn't going on really fast, isn't it?