Reproducible builds mean that rustc always generates the same output
for any given source code and configuration. It doesn't do that today,
but it could, and will need to eventually.
Reproducible builds would help us ensure the security of Rust's build
environment by allowing independent verification that the source code
for a Rust release produces the binaries we say it does.
I want people to be able to take our source code, write x.py verify-release,
and the build system will run x.py dist then verify that the result is
the same one rust-lang signed and published.
With that we can set up independent build environments that confirm
that the official binaries were built, without tampering, by the
previous official binaries. We could provide a tool that would just
deploy the whole setup to EC2 and start verifying what the official
build machines are doing.
Having such a tool would give us more confidence in the integrity of
the compiler. The more releases in a row that other people verify,
the more confident people can be that the compiler is not subject
to a backdoor inserted by a compromised build server.
I could imagine that once we have independent verification of the
rustc builds going forward, we could also put together a project to
reconstruct the complete rustc bootstrap, from the ocaml compiler
until it joins the binary-reproducible history. And then we would
have some strong confidence that there are no backdoors in rustc.
If this sounds cool to you, then why not go make rustc builds reproducible?
