Why reproducibility matters | Foundationfoundationdevices.com/2023/08/why-reproducibility-matters/
1225 sats \ 6 comments \ @foundationdvcs 9 Aug 2023 tech
write
preview
related posts
110 sats \ 3 replies \ @BlokchainB 9 Aug 2023
It matters but the common person can’t do it.
reply
0 sats \ 2 replies \ @foundationdvcs OP 9 Aug 2023
We've made it pretty much copy and paste for many users with our new guide, but it's certainly a difficult barrier of entry for many to even open a CLI!
https://github.com/Foundation-Devices/passport2/blob/main/REPRODUCIBILITY.md
Definitely something we can improve on and continue to make easier for the masses, and until then sites like Wallet Scrutiny can help people make decisions based on reproducibility and/or compare their results.
reply
10 sats \ 1 reply \ @BlokchainB 9 Aug 2023
Not to be cynical but I looked at this
In order to build and verify the reproducibility of Passport firmware, you will need to: Get the source code Install the dependencies Docker Just Build the reproducible binaries Verify the binaries match the: Published build hash Release binary (with signatures stripped out) hash We’ll walk through every step above in this guide to ensure you can build and verify any version of Passport’s firmware easily.
So to do this you need docker and just. I’m just confused as things should be reproducible but depend on docker which I heard of and just which I have never heard of. I am assuming they are trusted software packages but can you do this rebuild without docker and just.
reply
0 sats \ 0 replies \ @foundationdvcs OP 10 Aug 2023
This is the easy path to make it more accessible, and relying on Docker is absolutely standard and almost required in reproducible builds. Justfiles are simply human-readable scripts in the style of Bash scripting that reduce the amount of copy-pasting without obfuscating anything (we link to all the relevant Justfile lines in the guide).
If you want to do this as "from scratch" as possible, I'd recommend looking at the Wallet Scrutiny script we recently built to help them verify builds here:
https://gitlab.com/walletscrutiny/walletScrutinyCom/-/blob/master/scripts/test/hardware/passport.sh
That removes all reliance on Just.
reply
10 sats \ 0 replies \ @zuspotirko 10 Aug 2023
I remember back in the day there was a famous computer vision neural network that achieved great results at the time but nobody could reproduce it since the randomness seed wasn't saved or deterministic. They published the weights but nodody could achieve the same weights or a model close to that performance
Can't remember what it was called - something similar to imgNet or photoNet or something
But yeah, for pure builds without ML there are plenty of CI/CD solutions helping out with this
reply
0 sats \ 0 replies \ @eggos 10 Aug 2023
Yeah it matters but only to the point when your technology is actually usable and is being used by many lmao
reply