Reproducible Builds and compiling scripts without random tokenisation

[TheDcoder]

Hello Everyone

Been a while since I had any useful ideas for AutoIt. Today I was thinking about having an option to compile a script without any obfuscation or tokenisation, or atleast, an option to specify the seed for the randomness in the tokenisation process to produce identical executables every-time.

This would be very useful for Open Source software where anyone can compile to source to produce a bit to bit copy of the compiled version by the developer. Currently there is no legal way to verify if a build has been built from a specific source, with this option it will be easy as compiling the code and comparing the builds

Something like #pragma compile(Tokenise, false), we can set the proposed Tokenise directive to true as default to maintain backward compatibility and to somewhat protect closed source software.

What do you guys think about this?

TD

Edited July 23, 2018 by TheDcoder
"form" to "from"

[TheDcoder]

Bump, almost 6 months and no reply

Edited July 23, 2018 by TheDcoder

[TheSaint]

You shouldn't have needed to bump. But clearly you did have to.

I am surprised you got no response, as I consider your request as quite worthwhile, going by our recent discussions.

Perhaps you should outlay your current situation, to make things perfectly clear to the powers-that-be, why this is needed.

Edited July 23, 2018 by TheSaint

[TheDcoder]

36 minutes ago, TheSaint said:

Perhaps you should outlay your current situation, to make things perfectly clear to the powers-that-be, why this is needed.

I agree.

A practical example and the reason why I am looking forward to this feature is because I develop a program called ProxAllium, it is a frontend for Tor which is a security related software, I won't go into much detail, but I will say that users of Tor and the Tor project take security/trustworthiness somewhat more seriously than normal people. In order for a software to be accepted by the community, the binaries should ideally be reproducible, so that they can verify that it has indeed been compiled from the public source code. Unfortunately it is impossible to do this in AutoIt as tokenization adds a random factor to the compile process

That is only one of the many advantages of reproducible builds, more incentives and advantages can be found here: https://reproducible-builds.org/

Also, the wikipedia entry on this topic: https://en.wikipedia.org/wiki/Deterministic_compilation

 

It is a valuable technique which open source software can take advantage of

Edited July 23, 2018 by TheDcoder

[RTFC]

Excellent idea, TD.

[Mobius]

Autocamo is able to do this with its ability to seed the bulders token generator. 

Many moons ago

[TheDcoder]

Good stuff @Mobius, I recall checking out AutoCamo a few years ago, but never downloaded it and had a proper look... until now that is, I see that you have discontinued it (which is sad), but we can salvage something from your project. Can you give us a brief explanation how you made it possible to have a custom seed?

[Mobius]

20 hours ago, TheDcoder said:

Good stuff @Mobius, I recall checking out AutoCamo a few years ago, but never downloaded it and had a proper look... until now that is, I see that you have discontinued it (which is sad), but we can salvage something from your project. Can you give us a brief explanation how you made it possible to have a custom seed?

That's ok @TheDcoder It's a fairly old tool (much like its creator) and not to everyone's taste (also like its creator ) , what it does is fairly moot these days.

Unfortunately the token seeding process involved physically modifying the machinations of the builder and the interpreter on the fly to allow for this procedure to work, It could be built into the builder by the developer of course but I'm guessing there are numerous good reasons for him not doing so.

Edited July 24, 2018 by Mobius
Busted wink

[TheDcoder]

2 hours ago, Mobius said:

That's ok @TheDcoder It's a fairly old tool (much like its creator) and not to everyone's taste (also like its creator ;)) , what it does is fairly moot these days.

2 hours ago, Mobius said:

Unfortunately the token seeding process involved physically modifying the machinations of the builder and the interpreter on the fly to allow for this procedure to work

I see, quite advanced stuff then. I was kind of hoping there was an easier way.

 

Maybe I should open a ticket about this and see what the Devs think?

[Mobius]

24 minutes ago, TheDcoder said:

Maybe I should open a ticket about this and see what the Devs think?

Not to be cruel (rare) but given the lack of attention this thread generated i doubt it would be high on the todo list if at all. You are of course free to ask.

[TheDcoder]

13 minutes ago, Mobius said:

Not to be cruel (rare)

No worries, didn't take offense

13 minutes ago, Mobius said:

given the lack of attention this thread generated i doubt it would be high on the todo list if at all. You are of course free to ask.

I think the same, but you can always try and see, would be nice if they implement it

[Earthshine]

well, now I am reading all about Reproducible Builds, and, thanks, this is great stuff. Let me learn and get back here in time. Basically, I do this stuff, but I have found some great nuggets of wisdom here: https://reproducible-builds.org/docs/

i always snapshot every build, we can trace everything, but still much I need learn. I even have zipped archives of builds they use to debug with when problems come up, has all the pdbs and whatnot.

Edited July 24, 2018 by Earthshine