> The developer signing the build provides sufficient guarantees.

There are tons of documented cases of people resorting to physical attacks to obtain valuable cryptographic signing keys stored in full in one place.

https://github.com/jlopp/physical-bitcoin-attacks

I can only guess the people painting targets on their backs that big are woefully unaware of it, or living in deep survivors bias.

Trusting control of the entire internet to the laptop memory holding the PGP signing key that signs debian packages of GCC was always an insane thing to do, and still is.

Imagine what happens when one of those maintainers decides they like bribes or do not like being hit with rubber hoses.

Quorum signing of full source bootstrapped deterministic builds completed on independently owned and geo-distributed hardware produced by different vendors is currently the only viable solution to greatly reduce the incentive to coerce maintainers.

▲

charcircuit a day ago | parent [-]

Reproducible builds and bootstrapping doesn't stop physical extortion of shipping a new compromised version either.

▲

lrvick 9 hours ago | parent [-]

Sure it does, if you deterministically full source bootstrap, build, and sign the same image m-of-n places with different hardware owned by different people, all of whom only sign if everyone gets identical results, and this can be easily verified with remote attestation at runtime on a running server.

This is not a fantasy. This is exactly how https://caution.co works.

We can cryptographically attest with high confidence what code is running on a remote server at any given moment with these tactics. Entire classes of attacks are taken off the table with this approach, including BGP attacks if deployed properly.

	▲	charcircuit 4 hours ago \| parent [-]
		You do not need bootstrapping or reproducibility for this. You can do the same thing just with a prebuilt OS and applications. This is my point. Bootstrapping and reproducibility are made up problems that people think are important but are not actually needed.