[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: maradns reproducibility fixes and the merits of picking a random num
From: |
Ludovic Courtès |
Subject: |
Re: maradns reproducibility fixes and the merits of picking a random number |
Date: |
Mon, 18 Jul 2022 13:21:34 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/28.1 (gnu/linux) |
Hi,
Vagrant Cascadian <vagrant@reproducible-builds.org> skribis:
> On 2022-07-11, Vagrant Cascadian wrote:
>> I hear Efraim say better to have unique randomness and no substitutes,
>> and I hear Tobias say more or less it's ok as long as upstream is right
>> about it being ok to embed a specific prime as other random numbers get
>> mixed in at runtime...
>
> Well, now that I hit send already, I guess another option is ... to have
> both?
>
> One package without patches that is not substitutable and not
> reproducible, and one with patches that is verifyably reproducible and
> substitutable?
Honestly, I don’t think it’s worth bothering about the non-substitutable
trick. In practice, maradns should be able to rely on /dev/urandom at
run time, right?
Ludo’.