I'm here today to talk to you about
diffoscope

and how you can use it as a better diff

or for Quality Assurance, etc., things
like that.

Moin!

Apparently that's like a north german
thing to say "welcome".

North german, north Denmark, Scandinavia,
that kind of thing, I'm told.

People are shaking their head, so I'm
going to assume that's true.

This is my first PC, an IBM 5155.

Sometimes, when you rebooted it, it would
launch into, it would somehow revert

from booting from the hard disk to booting
from a basic ROM,

as in the programming language ROM.

It was on my motherboard for some reason.

So, randomly, you just get a chance to
program in basic and then,

sometimes you wouldn't, I don't know why,
but… yeah.

It's quite fun with this kind of clicky
keyboard, and that folded in

and it was this kind of big desk thing.

Anyway…

This is my first Debian.

At the time it was already old.

What's this one? Is this Slink? 2.2?
Yeah.

And this is when we had US and non-US,
so that's really dating if you remember that.

This is my first contribution to Debian,
19th December 2006,

sending a patch to lillypond which is kind
of interesting

and the response was "Oh yeah, rock on,
many thanks. I'll upload this and

it'll be landing to Etch".

And this was super motivating because
Etch was just coming out and it was like

"Great, I've got let one line of tiny patch
in a release. This is super cool."

Thomas' response was super motivating.

So, after that, like that Christmas
basically spent ???

Debian webpages and stuff.

Very well timed.

That's kind of a good…

You know, someone sends a patch, be like
"Cool, thanks"

Like a little notice in the changelog.

It was, you know, so stupid but…
Yeah, do that kind of thing.

So, moving on.

Why diffoscope?
Why did we write diffoscope?

What's the background here?

It comes from reproducible builds.

The very quick outline is that once you
get the source code for free software,

you download the source code for nginx
or whatever,

pretty much everyone just runs binaries
on their servers or their systems.

You know, "apt install bla", "yum install",
whatever.

Android Playstore, whatever.

Can you actually trust whether these two
things correspond with each other?

You've gotten the source code, it looks
alright, and then you install this binary,

yeah…

Who generated that? Can you trust that
process?

Can you trust who generated it?

Even if you could trust them, could you
trust them not to be exploited? Etc.

This is a big problem because you can
exploit a build farm and then

obviously exploit all of that, you know,
a trojan into the build farm,

so every single binary that comes out
is compromised.

Kind of problematic.

You could also target individual developers
machines,

so I could go of to, say, your machine,
add a backdoor to it,

so every binary that you give to friends
and things like that,

are compromised in some way, stealing
your bitcoins or whatever.

I can also ???
and blackmail you into producing

software that has compromises or extra
features, shall we say,

that don't exist in the source code.

So what will happen there is that you'd
release your source

and the binaries you produce have
this sort of backdoor that, you know,

someone is forcing you into producing.

So, you don't want to do that.

Anyway

enough of that.

What you do for reproducible builds is you
ensure that every time you build

a piece of software, you get an identical
result.

Multiple people then compare their builds
and check whether they all get

the same results

and this means that an attacker must
either have infected everyone

at the same time, or they haven't
infected anyone.

The point here is that you have to ensure
that builds have identical results.

Ok, great.

So, we started the reproducible builds
project, etc.

And we build 2 debs.

Oh, I'm sorry about the colors there.

You probably can't see that.

That says "sha1sum a.deb b.deb".

Anyway, we're comparing the sha1sums
of 2 binary Debian files.

So, these two files differ.

Ok, they're not reproducible.

Why is that?

So we run a diff on them.

Yeah…

So, what can we learn from this?

Well, not very much, visibly they're
compressed so

as soon as we see one change, we'll see
they would just cascade changes

because that's how compression works.

I guess we know it's a deb ???
format file, not very useful.

Ok, great so we're gonna have a look in

We'll do a binary diff and ok, well…

Again, that's not really telling us
very much

with the diff there.

Ok, great.

???

"ar x" is on the new maintainer thing,
"how you unpack a deb"

Everyone remembers this, right?

You unpack a.deb with "ar x" and you
do that to b.deb

and then we diff the results of that.

Ok, so…yeah, 7zip.

Ok, compressed content, not very useful.

Ok, so let's unpack the control.tar inside
these debs.

And then we run diff on that.

Still not really telling anything useful
about how to make this package reproducible

So let's unpack the tar.xz into the tar.

Inside that tar, there's a file called
md5sums and we start to see some differences

between some files in these two debs.

??? meaningful, so now
we have some idea that

it has something to do with this
usr/bin/pmixer binary.

Ok, interesting.

We'll unzip that and then we do a diff on
pmixer itself.

Now we're back into just binary
??? mode

This isn't very helpful and this is taking
quite a while

and if I remember correctly, Debian has
a lot of packages.

So this might take a little while.

So, basically, ??? meme

I should build a better diff.