Guix Reduces Bootstrap Seed by Half

https://guix.gnu.org/blog/2019/guix-reduces-bootstrap-seed-by-50/

by stargrave • 7 years ago

284 76 7 years ago

guix.gnu.org

m4r35n357• 7 years ago

Fascinating stuff!

Dayum...just how far do the turtles go? Even when they reach full source bootstrap, are they ruminating over concerns about the firmware/BIOS? If those concerns are addressed with an equivalent bootstrap-seeded coreboot, then are there concerns with the silicon? I never even thought someone was taking this level of security seriously enough to actually put the effort into it, but I'm extremely glad to see they are. I can easily see high-security DevOps builds of secrets management stores driven by such a bootstrapped Guix to nearly indefinitely satisfy the provenance-type questions from the regulatory compliance teams I work with.

secraetomani5• 7 years ago

secrets management stores

Maybe starting from something like an Arduino is a better route for that.

everlastingfan3• 7 years ago

Is Arduino firmware open? Are the PCB and chip designs open?

z29LiTp5qUC30n• 7 years ago

well if you look at #bootstrappable's logs it looks like they are planning on building custom hardware out of TTL chips to eliminate all software/bios/firmware from the bootstrap; which when combined with libresilicon means no place for any attacks to hide.

nwah1• 7 years ago

Unless Dennis Ritchie or Ken Thompson placed a "trusting trust" attack in the original C compiler, since virtually all modern code was compiled by something that was once compiled by it.

(Ken Thompson coined the term and knows how to do it.)

everlastingfan3• 7 years ago

Well there is when you design signals that play on the physical properties of the silicon and the silicon design is known, think Rowhammer. The next level of this is making permanent modifications to the silicon, e.g. using focused RF signals to change the properties of individual transistors.

Relying on security through obscurity is bad, but you need some obscurity.

Passwords and keyfiles are ultimately a form of security through obscurity.

jtl999• 7 years ago

building custom hardware out of TTL chips to eliminate all software/bios/firmware from the bootstrap

I'd be curious to learn more about this.

kragen3• 7 years ago

“Planning on” is an exaggeration. It would be good if someone did that, but those 120MB are still five orders of magnitude bigger than the MES seed, and that's a much bigger problem right now.

everlastingfan3• 7 years ago

It's turtles all the way down.

I'm ruminating on the potential for "regular" electric signals to carry quantum information, that's the next aspect of security to consider with quantum around the corner.

So don't worry, there are and will be bigger things to worry about.

chungy2• 7 years ago

Malicious firmware concerns might be alleviated with cross-compilation. There might be an assumption that firmware inserting untrusted code only actually inserts trusted code of its native architecture, though even this is no guarantee.

orblivion• 7 years ago

If you're worried enough, I think there's some trick where you use multiple different C compilers made by different organizations to build (let's say) gcc. Then you use all those gccs to rebuild gcc in a deterministic way. If all of those rebuilt gccs are byte-for-byte the same, then either it's safe, or all of the initial compilers you used were in cahoots. Depending on who you pick to start, that's arguably very unlikely.

thfuran• 7 years ago

If all of those rebuilt gccs are byte-for-byte the same

Isn't that pretty unlikely even if all the compilers are uncompromised?

mikelevins• 7 years ago

There are researchers considering things all the way down to silicon.

I worked on a contract for about a year and a half on a subproject of the research program described in this New York Times article:

  https://www.nytimes.com/2012/10/30/science/rethinking-the-computer-at-80.html

The project I consulted on was an attempt at a comprehensive system design that replaced everything all the way down to and including the hardware. System software was written in Haskell and in a newly-designed language called Breeze that offered both static and dynamic typing. The dynamic typing was supported by tagged hardware with specialized instructions (that effort included Tom Knight, one of the original designers of Lisp Machines).

The organizing principle was that every piece of code and data was owned by a well-defined system entity with well-defined permissions that were proven correct both statically and dynamically. For example, sending data to an endpoint that did not have the required authorization to receive it was a type error.

The thinking was that the state of the art is so broken (from the point of view of data integrity and security) that it's necessary to start from scratch. The overarching project name, appropriately enough, was "Clean Slate".

I don't know what they're up to now.

xvilka2• 7 years ago

I wonder if they target RISC-V platform too. Or OpenPOWER (the case of Raptor Engineering).

chungy2• 7 years ago

Seems to be only i686 and x86_64. It's a pretty small project all things considered, but I'm sure a porting effort would be appreciated.

tremon• 7 years ago

from the article (default blurb added to the end of every blog post):

it can be used as a standalone operating system distribution for i686, x86_64, ARMv7, and AArch64 machines.

kragen3• 7 years ago

It isn't necessary for the original bootstrap seed to run on many platforms. Just at least one trustworthy one. From there we can cross-compile everything else.

xvilka2• 7 years ago

And x86 is the least trustworthy one. With all these hidden modes of execution from Intel and AMD...

equalunique3• 7 years ago

The first step would be getting Mes[0] built for RISC-V / OpenPOWER. Want to give it a shot and let Guix devs know how it went?

[0] https://www.gnu.org/software/mes/

atian• 7 years ago

Yeah startups are gonna need another way of financing fast if seed amounts keep going down. If anything the startup age is over on the west coast.

moomin• 7 years ago

When you only read the headline.

reacweb• 7 years ago

I do not understand. When I have started on linux, 25 floppies were enough for a full installation (including latex and X) on my big HD (120MB). How a striped down version of bash, coreutils&co and guile could require 120MB ?

asutekku• 7 years ago

There’s a bunch of more stuff available on it nowadays.

giancarlostoro• 7 years ago

And lots of hardware drivers, for lots of potential hardware I assume as well. I bet Gentoo could be setup to be entirely minimal by removing uneeded things from the distro, not sure if it's known for that.

secraetomani5• 7 years ago

And a typical install of Windows 95 was 55 MB. Which included a bunch of images, sounds, ...

oblio3• 7 years ago

images

800x600 16 bit backgrounds and 16x16 16 bit icons...

sounds

MIDI sounds...

We're not living in 1995, anymore.

folkrav• 7 years ago

I'd be curious about comparing the resolution, color depth and compression levels of those images, and the bitrate/compression levels/codec of those sounds. Let's take one wallpaper. Win95 must have included a what, max 1024x768 wallpaper size? Assuming identical compression and color depths, that's still 786432 pixels total, compared to the 4K wallpapers we get today with 8294400 pixels - a larger than 10x increase. That's vastly oversimplifying, as a 10x pixel count doesn't directly translate to a 10x file size, but still, that's just for one image.

Pretty sure sounds in Win95 were MIDI, which aren't even actual audio files.

yjftsjthsd-h• 7 years ago

But crucially, it didn't ship any compiler chain capable of building itself; I know compilers were smaller then, but apples-apples...

swiley2• 7 years ago

If it bothers you, try alpine. I think the minimal rootfs on their site is 3MB or so.

MayeulC2• 7 years ago

Though the kernel itself might sit at ~60 MB (depending on compile-time options), and you might need to addd another 120MB for the firmware.

Of course, this can be stripped down a lot if you decide to taylor the kernel to your system (less drivers, etc).

To answer GP, a full texlive installation takes around 2GB on my system. That's mostly fonts, but also packages, tools and documentation. I take the bloat for convenience, because I can afford a few extra GBs nowadays. If you want to go for minimalism, you still can (and even reach smaller footprints than back then), but that's no longer the mainstream option. Not when a GB is a few cents.

davexunit• 7 years ago

There's a significant difference between bootstrap binaries and the actual distro binaries and this thread seems to be conflating the two. Out of curiosity, does anyone know how big Alpine's set of bootstrap binaries are? This article estimated Debian's to be ~550MB. It would be interesting to know which distro has the least amount of stuff taken for granted.

sideeffffect• 7 years ago

I suspect that the big part of that 120MB is bootstrap-guile (Guile is a Scheme implementation)

if you want to go really minimalistic, see stage0, it's like 500 Bytes

https://github.com/oriansj/stage0

details are in the article

bArray• 7 years ago

Can you elaborate on what stage0 does? I'm not sure I understand what it means by "bootstrap".

pera• 7 years ago

That's likely the case: at least in Arch Linux, Guile+deps is about 50MB.

nrclark• 7 years ago

Out of curiosity, what makes Guile take up so much space?

I considered using Guile as the scripting/extension language in some of our tools, but I couldn't get over the large size and the number of additional dependencies it introduced.

There's a certain irony to the idea that Guile was designed to be a TCL killer, and wound up being larger and harder to deploy.

mhd• 7 years ago

| Bootstrapping in this context refers to how the distribution gets built from nothing.

The GNU build system was huge since about forever.

gglitch• 7 years ago

Neat - MES Scheme is apparently named after Alan Kay's description of Lisp as the Maxwell's equations of software.

https://gitlab.com/janneke/mes

equalunique3• 7 years ago

That information is also given on the GNU page: https://www.gnu.org/software/mes/

antoineMoPa• 7 years ago

Anyone using Guix in production? (Anyone using Guix?)

uncletaco2• 7 years ago

Not in "production" but I use it on my personal laptop and desktop. I wanted to learn a scheme and I figured what better way than to dedicate all of my home computing time to configuring a system and crying myself to sleep trying to build firefox on it.

robto• 7 years ago

If you get firefox working, please share your definition on the nonguix[0] repo. Lack of Firefox is what is currently holding me back from installing Guix on hardware. I don't know anything about package building, but I'd be happy to help collaborate if you need it.

[0]https://gitlab.com/nonguix/nonguix

garmaine2• 7 years ago

Bitcoin. All bitcoin binary releases going forward are compiled with Guix for reproducibility. (The Bitcoin Core team previously used an in-house guix-like thing that they developed themselves. They switched to guix this year.)

equalunique3• 7 years ago

Hey, that's awesome. Can you share some links on it?

rendaw• 7 years ago

I'm using it on my fileserver, swimmingly. I build the image on my desktop and then swap the boot drive and restart. It replaced some Arch linux hack scripts I was using to do the same, and with much less external tooling.

I wrote up a general guide here along the way: https://gitlab.com/rendaw/blog/blob/master/how_to_guix_for_t...

archi42• 7 years ago

So the only trust anchor remaining are the kernel and the hardware. It seems an attacker has to build a kernel module that detects the bootstrapping process and injects the (self-replicating!) bad code while building the final gcc.

I like the work, but I still don't think the kind of attack mitigated here is practical. OTOH it's nice to have the option (if I was to build/publish my own distribution I would use this as my trust anchor, plus some ancient hardware and Linux 2.4 CDs to build my own bootstrap environment; though as a random guy on the internet I am probably less trustable than e.g. the Debian people).

Guix Reduces Bootstrap Seed by Half

Related Stories