> this file was independently reproduced by <name of trusted party>
Sounds risky, unless paired with strong policy about what a verifier should do.
e.g. if the verifier just grants network access to the buildbot that then checks what the result should look like, then compromise could remain invisible while the label silently downgrade to "independently downloaded by".
And I do not expect there are many parties that would be willing to provide such service beyond their own needs, while simultaneously not already providing that service in places where the infrastructure and policies are already set (such as Debian). Or at least they would already contribute towards build dependencies that do not break reproducibility on every other version bump.
These people are so far gone in their fantasy land...
> So we either have to shrug and say, "don't use sdists if you want reproducible builds,"
What is this, I can't even... How can anyone expect to have a reproducible build's artifact if they downloaded the source?
Now, and most importantly, all this talk is about "pure" (as in Python-only) packages. This is, practically, worthless for most real Python projects because those rely on native bindings. Why should anyone expect PyPI to be able to build those if no standard procedure exists for building them is beyond comprehension.
> this file was independently reproduced by <name of trusted party>
Sounds risky, unless paired with strong policy about what a verifier should do. e.g. if the verifier just grants network access to the buildbot that then checks what the result should look like, then compromise could remain invisible while the label silently downgrade to "independently downloaded by". And I do not expect there are many parties that would be willing to provide such service beyond their own needs, while simultaneously not already providing that service in places where the infrastructure and policies are already set (such as Debian). Or at least they would already contribute towards build dependencies that do not break reproducibility on every other version bump.
These people are so far gone in their fantasy land...
> So we either have to shrug and say, "don't use sdists if you want reproducible builds,"
What is this, I can't even... How can anyone expect to have a reproducible build's artifact if they downloaded the source?
Now, and most importantly, all this talk is about "pure" (as in Python-only) packages. This is, practically, worthless for most real Python projects because those rely on native bindings. Why should anyone expect PyPI to be able to build those if no standard procedure exists for building them is beyond comprehension.