Packages

packages is a security first repository of reproducible and cryptographically signed OCI images (used by Docker, Podman, Buildah etc.) of common open source software packages built from source.

These images can be used as part of a secure supply chain strategy for a wide variety of use-cases. Some examples include local environment setup, hardening CI/CD pipelines or bootstrapping Linux distributions used in production.

Background

We have learned a lot of lessons about supply chain integrity over the years and the greatest of them may be that any system that is complex to review, and assigns trust of significant components to individuals, creates enormous single points of failure which will lead to eventual compromise.

Distros (Linux distributions) rely on complex package management systems for which only a single implementation exists. They typically generate a lot of custom tooling, which in turn rapidly grows in complexity to meet demands ranging from hobby desktops to production servers. This complexity demands a lot of effort to maintain, and in practice results in a tendency to reduce security overhead in order to lower the barrier to entry to attract more maintainers. As a result, projects rarely mandate cryptographic signing or reproducible builds, let alone multiple signed reproduction proofs. In fact, some popular distros use a server to blindly sign all contributions from the public, which can give a false sense of security to the unassuming user.

We will cover an exhaustive comparison of the supply chain strategies of other package management solutions elsewhere, but while many are pursuing reproducible builds, minimalism, or signing, there isn't a solution which delivers on all of these basic tenets of supply chain security. packages is an attempt to fix this, in order to satisfy the criteria of reasonably secure supply chain strategy which requires more than one individual to deterministically build and sign software.

Goals

Not all of these goals are realized yet, but should at least help you decide if this project is something you want to contribute to or keep an eye on for the future.

Integrity

• Anyone can reproduce the entire tree with tools from their current distro
• Hosted CI servers auto-sign confirmed deterministic builds
  • Like NixOS
• Maintainers sign all package additions/changes
  • Like Gentoo, Debian, Fedora, Guix
• Reviewers locally build and counter-sign all new binary packages
  • No one does this, as far as we can tell.

Reproducibility

• Trust no single external source of binaries
  • Bootstrap from two different third party signed distros
• Never use external binaries
  • Bootstrap from 0, always, even if it means going back in time
    • Go, rust require extensive work to bootstrap all the way back to gcc
    • Guix is the only distro that does this for rust to our knowledge
• Full-Source Bootstrap from x86_64 assembly
  • Take maximum advantage of the hard won wins by the Guix team
  • Bootstrap from guile driver reproduced on multiple signed distros

Minimalism

• Based on musl libc
  • Basis of successful minimal distros like Alpine, Adelie, Talos, Void
  • Implemented with about 1/4 the code of glibc
  • Required to produce portable static binaries in some languages
  • Less prone to buffer overflows
  • Puts being light, fast, and correct before compatibility
• Package using tools you already have
  • OCI build tool of choice (Docker, Buildah, Podman)
  • Make (for dependency management)
  • Prove hashes of bootstrap layer builds match before proceeding
• Keep package definitions lean and readable with simple CLI and no magic

Building

Requirements

• An OCI building runtime
  • Currently Docker supported, but will support Buildah and Podman
• Gnu Make

Examples

Compile all packages

make

Compile specific package

make out/rust.tgz

Reproduce all changed packages

make reproduce

Reproduce all packages without cache

make clean reproduce

Sign current manifest of package hashes

make sign

Packaging

Every package should have a minimum of 5 stages as follows

• base
  • Based on busybox or bootstrap
  • Runs as unprivileged user 1000 (user)
  • Sets environment to be shared with fetch, build, and install stages
  • Imports dependencies for fetch, build, and install stages
• fetch
  • Based on "base"
  • Runs as unprivileged user 1000 (user)
  • Has internet access
  • Obtains any needed source files from the internet
  • Verifies sources against hardcoded hashes
• build
  • Based on "fetch"
  • Runs as unprivileged user 1000 (user)
  • Extract sources
  • Apply any patches as needed
  • Build any artifacts as needed
• install
  • Based on "build"
  • Elevates privileges to user 0:0 (root)
  • Installs all files in /home/user/rootfs owned by root
  • Sets all timestamps in /home/user/rootfs to @0 (Unix Epoch)
• package
  • Based on scratch
  • Copies /home/user/rootfs from "install" to /
  • Sets runtime user/perms/env as needed

Sponsors

• Turnkey
• Distrust
• Mysten Labs