So, we are going to continue now on the topic of making things more deterministic.
And the next talk is going to be about Lila, which is a decentralized tool for making reproducible
build, like very fine reproducible, making it verifiable, the build are reproducible.
In the next so as ecosystem, and the speakers today are Julien Marca and Rabuf, are also known
as Ano Engel, thank you very much, and I am sure they are going to give a great talk.
We are going to do the cool thing where they hold another Yimike, because there are two speakers
and we only have one microphone, because I am keeping this one.
All right, so, around the class for our speakers, and enjoy.
Thank you, Martin, so I am Julien, this is Rabuf and we are going to talk about a tool called Lila.
So, this presentation is about software supply chain and software supply chain security,
because Lila is a tool that we designed to improve the software supply chain security.
And especially the kind of question that it solves is a problem in software supply chain security
that can happen at build or distribution time, which means essentially it solves the question
of what if there was a not occur malicious person that gained control of the Nixx build infrastructure
and was able to put in the cache some binary with some backdoor.
And there is a generic solution to this that has been developed in the last ten years.
It's the idea of build or reproducibility.
So, if a build or reproducibility is what is the property of software components,
where when you build that software several times and several machines,
you get the exact same bit by bit results.
And this simple idea brings a lot of benefits for software distribution,
because then you can, when you are downloading a binary from someone,
let's say the Nixxx cache, you could also ask some other
people to rebuild the same software and verify that everybody agrees that whatever you're
downloading from the cache is whatever you agrees that the software should be.
So, there is this effort called reproducible builds with a lot of people working together
to build a build of software more reproducible.
And for to get the benefits of this, you need to kind of check all the software in Nixx
and check if they are reproducible.
So, last year in the same devroom, maybe some of you remember,
I presented some of my research that I do as part of my PhD,
where I essentially tried the evaluator reproducibility of all packages in Nixx
through time and our main research was that as of today,
the reproducibility of Nixxx is about the 90% mark.
So, this is all cool, but the problem is that to do that, it took us 15,000 hours of build time
and 10 machines.
So, so we are the only one doing it, so you have to kind of trust us on this, on the results.
And so it kind of defeat a bit the purpose of build reproducibility.
And so, all this makes it difficult to sustain kind of monitoring for the Nixx community
because of the enormous size of the package that.
So, we decided we needed something else.
Yes, and that something else is called lila, and lila is hash collection infrastructure.
And that means if people run builds, they hash the result and they send a sign to the hash collection infrastructure.
So, because we collect all those hashes, if the hash is matched, then we know there are several
people who have gotten the same result. And the good thing is about the good thing about this is
because you sign the hashes, people do not need to trust us, we just pass along the hashes,
but you can trust to people who actually build the stuff.
And so we don't use this, so we intend to use this for two different things.
One thing is a trust in the reproducibility, the fact that something has been reproduced.
So, that's something you will do downstream, but we also want to use this information
to create reporting on the reproducibility of the packages so we can fix all the packages that are
not yet reproducible. So, what does this look like? I'm sorry.
So, a little bit of history, we started in a few years ago, we wanted it this for a while,
but 2024 we started series depending on it. We applied for some funding, but that it happened,
so we started it now free time, might some weekends.
25, we participated in this of an excellent next security project. We got
funding for a slice of our milestones, so that was really good. That was gave us a boost to get
to today, and today we can proudly present that Lila is now backing the reproducibility
graphs and reports that you can find on reproducible the next west of the arc.
So, what does this look like? This gives you reproducibility over time.
It gives you information about, for example, the minimal ISO runtime derivation,
and so specific package sets, information about specific package sets,
details about which exact derivation in those package sets are reproducible or not.
This can also be linked to issues. We have dependency graphs. So, what's next, how can you help?
Become a rebuilder. It's pretty easy. Find us on matrix or find us on reproducibility.
But next west of the arc, fix the actual issues that we find. So, the issues that are
read in the reports, and if you're a developer, then we have a bunch of ideas and I bet you
also have a bunch of ideas to make reproducibility on the next west, even better.
That's it for us.