<story><title>Deterministic, bit-identical and/or verifiable Linux builds</title><url>https://bugzilla.mozilla.org/show_bug.cgi?id=885777</url><text></text></story><parent_chain></parent_chain><comment><author>indygreg2</author><text>I filed the linked bug and am the technical owner of Firefox&amp;#x27;s build system.&lt;p&gt;There were efforts made and discussions outside of the linked bug. To say &amp;quot;nothing&amp;quot; was done is just not true.&lt;p&gt;It would be more accurate to say that we just can&amp;#x27;t justify working on this right now because the timing isn&amp;#x27;t right and it&amp;#x27;s high cost for perceived low reward. The time of everyone involved to implement this would be better spent on improvements that benefit the general Firefox population. Some of those improvements include overhauling Firefox&amp;#x27;s build automation to better support things like building with Docker. That lays the groundwork for (easier) deterministic builds in the future. Even then, I&amp;#x27;m not sure if this will happen. Brendan&amp;#x27;s post called on the larger community to make requests of Mozilla. That front has been surprisingly quiet. If you really want this, I would suggest making noise on the mozilla.org domain. Even better, contribute some patches, like the Tor Project has done: I will happily review them! #build on irc.mozilla.org.</text></comment>
<story><title>Deterministic, bit-identical and/or verifiable Linux builds</title><url>https://bugzilla.mozilla.org/show_bug.cgi?id=885777</url><text></text></story><parent_chain></parent_chain><comment><author>zz1</author><text>On January 2014 Brendan Eich [1] called out for organization to build up a system to verify Firefox builds in order to secure the browser can&amp;#x27;t be used as an attack vector being distributed with some malicious feature added to what&amp;#x27;s in the source code.&lt;p&gt;Six months later nothing is done, that is because Firefox build are not deterministic yet. If you think this is an important issue, please vote this bug.&lt;p&gt;Edit: [1] &lt;a href=&quot;https://brendaneich.com/2014/01/trust-but-verify/&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;brendaneich.com&amp;#x2F;2014&amp;#x2F;01&amp;#x2F;trust-but-verify&amp;#x2F;&lt;/a&gt;</text></comment>