Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add section on reproducibility of builds #48

Merged
merged 1 commit into from
Aug 14, 2023
Merged

Add section on reproducibility of builds #48

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,11 @@

Multi-platform Thrift compiler.

JAR that packages precompiled Thrift compiler binaries for Windows and Linux x86, providing portability
across this limited set of platforms. Supports all Thrift versions >=0.6.0 for Windows and 0.18.1 for Linux
x86. As Thrift only published binaries for Windows, there is no possibility to download the binaries and
avoid using the embedded ones for now.
Executable JAR that packages precompiled Thrift compiler binaries for Windows and Linux systems,
providing portability across these platforms. Supports all Thrift versions starting at 0.6.0 for Windows
and Linux systems running on 64-bit x86, aarch64, s390x, ppc64le, and armv7 machines. As Thrift only
publishes binaries for Windows, it is impossible to avoid using the embedded binaries and instead
download them on the fly.

## Usage

Expand Down Expand Up @@ -69,3 +70,13 @@ Then, you can use the project by including the following Maven dependency in you
<version>1.0.0-SNAPSHOT</version>
</dependency>
```

## Reproducibility

This project contains precompiled binaries. These can pose large security risks. After all, why would
they be trusted? To take away some of these concerns, the used binaries are built transparently using
the actions in the [amousavigourabi/thrift-binary](https://github.com/amousavigourabi/thrift-binary)
repository. These builds are designed to be fully reproducible by re-running the actions. This can be
done by creating your own fork and triggering the run of the build workflow. By comparing the outputs
of this new run and the binaries included in this project, it can be verified that no malicious code was
injected in the pre-compiled binaries.