Security and Productivity - Pick Two with Reproducible builds

fl ThunderKiss Photography ickr.com/photos/treycampbell/4512662113 Security and Productivity Pick Two with Reproducible Builds Brian Demers Open Source Developer BrianDemers bdemers

@BrianDemers | bdemers

Who is this guy? @BrianDemers | bdemers

source: Silicon Valley @BrianDemers | bdemers

VS @BrianDemers | bdemers

VS @BrianDemers | bdemers

Developer Productivity Engineering @BrianDemers | bdemers

Topics • • • Reproducible Builds • What is it? • Why should you care? Developer productivity • How are these related? • Build Cache Tips & Tricks @BrianDemers | bdemers

Source Build Build Verify reproducible-builds.org @BrianDemers | bdemers

Source Build Build Verify @BrianDemers | bdemers

03ba204e50d126e4… data @BrianDemers | bdemers hash function

How did we get here? @BrianDemers | bdemers

Old way (META-INF/MANIFEST.MF) Manifest-Version: 1.0 Archiver-Version: Plexus Archiver Created-By: Apache Maven Built-By: jdcasey Build-Jdk: 1.4.2_09 Extension-Name: maven-core Specification-Title: Maven is a project development management and com prehension tool. Based on the concept of a project object model: buil ds, dependency management, documentation creation, site publication, and distribution publication are all controlled from the declarative file. Maven can be extended by plugins to utilise a number of other d evelopment tools for reporting or the build process. Specification-Vendor: Apache Software Foundation Implementation-Vendor: Apache Software Foundation Implementation-Title: maven-core Implementation-Version: 2.0.1 @BrianDemers | bdemers

New Way (META-INF/MANIFEST.MF) Manifest-Version: 1.0 Created-By: Maven JAR Plugin 3.3.0 Build-Jdk-Spec: 17 Specification-Title: Maven Core Specification-Version: 3.9 Specification-Vendor: The Apache Software Foundation Implementation-Title: Maven Core Implementation-Version: 3.9.4 Implementation-Vendor: The Apache Software Foundation @BrianDemers | bdemers

@BrianDemers | bdemers

@BrianDemers | bdemers

Reproducible builds for security • Binaries are not tampered with • Build system not comprimised • Prevent backdoors • Supply Chain attacks @BrianDemers | bdemers

Compromised Toolchain $ cp evil-compiler /usr/bin/compiler $ unzip evil.zip -d /src/project extracting @BrianDemers | bdemers ../../etc/passwd

Who should care? • Open Source Projects • Distributions • Companies • Users

Shouldn’t All Builds be Reproducible? @BrianDemers | bdemers

📆 Dates ⏰ • Current date/time • Time Zone • Locale/Format • Dates in versions

File Dates $ ls -alh target/scim-core-1.0.0-SNAPSHOT.jar -rw-r—r— bdemers staff 56K Jul 27 12:32:43 2023 @BrianDemers | bdemers

Dates in Archives (zip, tar, jar, etc) Archive: target/scim-core-1.0.0-SNAPSHOT.jar Date Time Name ————— ———-04-05-2023 08:23 META-INF/MANIFEST.MF 04-05-2023 08:23 META-INF/DEPENDENCIES 04-05-2023 08:23 META-INF/LICENSE 04-05-2023 08:23 META-INF/NOTICE 04-05-2023 08:23 META-INF/beans.xml 04-05-2023 08:23 META-INF/maven/org.apache.directory.scim/scim-core/pom.xml 04-05-2023 08:23 META-INF/maven/org.apache.directory.scim/scim-core/pom.properties 04-05-2023 08:23 org/apache/directory/scim/core/repository/PatchHandler.class 04-05-2023 08:23 org/apache/directory/scim/core/repository/Repository.class 04-05-2023 08:23 org/apache/directory/scim/core/repository/UpdateRequest.class … @BrianDemers | bdemers

Random bits xkcd.com/221 @BrianDemers | bdemers

OS & Environment • File Encoding • OS • Tool Versions • File Paths • Locales • .DS_Store @BrianDemers | bdemers Save the Environment

xkcd.com/1834 File Input / Output Order • Hash Maps • • Serialized data File order in archives

@BrianDemers | bdemers

How to Verify? $ shasum -a 256 AAA-file.zip 80da7adf80a819db609ac6862931dc6c1cc04bf4c8ba292446021aa805aa3bfa $ shasum -a 256 BBB-file.zip 80da7adf80a819db609ac6862931dc6c1cc04bf4c8ba292446021aa805aa3bfa @BrianDemers | bdemers

Diffoscope @BrianDemers | bdemers

jvm-repo-rebuild/reproducible-central @BrianDemers | bdemers

How to get started? @BrianDemers | bdemers

Maven & Gradle <!— Maven —> <properties> <project.build.outputTimestamp> 2023-01-01T00:00:00Z </project.build.outputTimestamp> </properties> // Gradle tasks.withType(AbstractArchiveTask).configureEach { preserveFileTimestamps = false reproducibleFileOrder = true } @BrianDemers | bdemers

Other Beni ts Quality • Debugging • Smaller deltas in releases • Cacheable fi • B s u n o

Think about a Docker builds @BrianDemers | bdemers

Build Caching ⬢ Introduced to the Java world by Gradle ⬢ Build caches are complementary to dependency in 2017 ⬢ Maven has an open source build cache caches, not mutually exclusive: ○ too ⬢ Used by leading technology dependencies ○ companies like Google and Facebook ⬢ Can support both user local and remote caching for distributed teams @BrianDemers | bdemers A dependency cache caches fully compiled A build cache accelerates building a single source repository ○ A build cache caches build actions (e.g. Gradle tasks or Maven goals)

What is a Build Cache? Inputs ● Gradle Tasks ● Maven Goal Executions Outputs When the inputs have not changed, the output can be reused from a previous run.

Cache Key/Value Calculation The cacheKey for Gradle Tasks/Maven Goals is based on the Inputs: cacheKey(javaCompile) = hash(sourceFiles, jdk version, classpath, compiler args) The cacheEntry contains the output: cacheEntry[cacheKey(javaCompile)] = fileTree(classFiles) For more information, see: https://docs.gradle.org/current/userguide/build_cache.html

When not using the build cache, with Maven any change will require a full build. For Gradle this is the case when doing clean builds and switching between branches.

Changing an public method in the export-api module

Changing an implementation detail of a method in the service module

Remote Build Cache ⬢ Shared among different machines ⬢ Speeds up development for the whole team ⬢ Reuses build results among CI agents/jobs and individual developers

source: https://www.cshl.edu/quiz/brain-interrupted/ @BrianDemers | bdemers

The anatomy of fast feedback cycles PRODUCTIVITY Less idle/ wait time Less context switching More focused developers QUALITY FASTER FEEDBACK CYCLES KEY: New behavior More frequent builds Earlier quality checks Fewer downstream incidents Smaller change sets Few merge conflicts Effect More efficient troubleshooting KEY BENEFIT @BrianDemers | bdemers Faster MTTR

Developer Productivity Engineering (DPE) @BrianDemers | bdemers

@BrianDemers | bdemers

Progression of Productivity @BrianDemers | bdemers

The Future Dwurban, CC BY-SA 4.0 https://commons.wikimedia.org/w/index.php?curid=116834907 @BrianDemers | bdemers

Other Ways to Speed up Builds • Update your build tool • Break project into modules • Predictive Test Selection • Test Distribution

@BrianDemers | bdemers

Questions? Thank you! BrianDemers bdemers Learn more & get free swag