Is this binary actually built from that public source code?

Transcript

[music] [music] Thank you K. Hello. Uh thank you K. So uh is binary actually built from that public source code is a question that I've been asking myself throughout my uh journey as an engineer whenever I would install any kind of tools. So uh I mean this question might make sense or uh not but uh to make more sense of it we can first understand the uh software release life cycle. So in a nutshell we basically have some source code on GitHub and then there is a team who compiles this uh

code and publishes the binary. So this can happen in uh in the uh CI or it can also happen on the developer machine as well. And then uh they also sign the binary using GPG uh signatures and from the user part of uh side. So we just go to our terminal and uh or or any application through which we install the binaries. We say brave install this and this or uh any uh client that we're installing. So it just downloads the binary from the CDN or somewhere. We verify the binary and then we execute code. We don't know if uh I mean that is a question if uh uh is this binary is actually built from that public source code that we installed. So usually we think that okay this is GPG signed so the signature verifies so I

guess it's fine right but then we can look at this. So there are a lot of incidents which I can just brush through because this is a lightning talk. So again now if you ask this question is this binary actually built from that public source code that we see on GitHub. So uh yeah I mean we can say that it's GitHub I mean it's uh GBA signed but then we actually don't know because we see the uh binary and then there is source code we have to reverse engineer the binary just to know if it's right. So uh now we can dive into this uh thing that how we can actually do the binary verification is that even possible and what people uh can do right now.

So uh one of the solution is self-build. I mean whoever is using that project uh if you are the user you can just clone the repo and then uh self-build and then basically add it to your system and that's how you can do it. But the thing is if uh you're using go it's fine but some of the uh tool chains like rust they take a lot of uh it's not practical basically and then there are companies like uh Google who have uh who know this problem and what they do with this public libraries is they have this uh they have a bucket in which they publish uh uh I mean hashes of popular libraries like ReactJS and all all of those things which are popular from npm and many ecosystems and anyone wants to see that.

So they can actually verify from their uh system and then there are teams like Bitcoin who have uh I mean whenever they want to release a binary uh they would just have the community actually build it and then when they publish a release the community would say that okay this binary looks good. So this is a manual process and again it requires a lot of uh people to coordinate and there are also more uh interesting solutions like zk proof of build you actually run the build entire thing in a zk proof but that's obviously very expensive and then uh uh we can I mean if you want to avoid zk you can do te but I think that's too much but then there is a solution which is in between

so on one end what we have is just one person that is a developer who signs the binary and builds the binary and publishes it and on the other end that is a self-built thing where everyone millions of users clone the repo build it and then publish it. Um so uh we can find something in between. So that is the social layer at a station where let's say a small set of people like 100 200 or maybe thousand people they just build it locally and then they publicly mention that okay I have tried building it and the hash looks good. So uh so I've uh tried to think about it and how we can actually do it in practice. So uh so there is this uh just a hobby side project that I

worked on. It's called legit.build. Uh you you can if you want you can open it in your uh system. So basically it works in a way that right now I'm just focusing on Ethereum client binaries like the EL and CL clients. So you can uh so let me go to the next slide. You can just copy this thing and put in your uh cloud code, cursor, whatever it is. You it will uh there is a prompt. It will just clone all the uh etherum clients or you can also specifically mention that I just want to attest get or whatever client you're interested in or whatever target it is. your uh system will build it and then it will publish the hash to uh EAS or uh uh there are

three back ends that I'm thinking about. So uh this is uh pretty much it. I mean uh this is the back slide. I mean first you uh build it on yourself and then you publish your test station and then whoever is interested in that uh binary they can actually check the network. So yeah uh this is it. Thank you very much, Zhan. [applause] I'm really glad that someone's making sure that our binaries are secure because I know not not enough people are actually checking them. We're just running arbitrary binaries and hoping for the best. Any questions?

>> It's kind of well, what about nicks and how do you achieve uh deterministic builds? That's the bigger question. Yeah, >> build is definitely something. I mean I I was just running the builds of all of the um clients all of the I was running the builds from for all all of the clients and not all of them have a good uh build pipeline. I mean I have to set a lot of flags to get deterministic building. So there are some clients in which time stamp is built in. So that that is uh that is a challenge right now. Not everyone is using that pipeline but but I I I've heard about this problem I know my friend was talking about but not a lot of people are using it. That that is the problem.

>> Thank you. [music]