Building reproducible Python applications for secured environments
summary
Builds a reproducible Debian package pipeline that actually works: uses pip --no-binary to fetch source tarballs, builds wheels locally, records and verifies wheel and source SHA256 sums, stores a GPG-signed SHA256 list, serves a static index.html private package index, and packages with dh-virtualenv into .deb files with double hash verification. Outcomes: one human reviewer per dependency, offline signing keys, reproducible bit-for-bit builds, and a deployable SecureDrop client on Qubes that cuts per‑item journalist handling from ~45 minutes to under five.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:45Tor Project
- 11:19Threats
- 14:44Make File Targets
- 21:10Virtual Env
- 26:52What Are the Places Do You Think Reproducible Build Could Be of Use
related talks
01h 21mSecure Python Packaging & Release Using Continuous Deployment
23mReproducible Environments for Reproducible Results
37mAutomated deployment of Python packages for development
34mSecure Python Development: Tips, Tricks, and Tools
47mReproducible builds
41mTaming the toxic python environment on your laptop
56mReproducible Builds, the first ten years
23mBuilding Secure Package Pipelines