If you look carefully at my proposal, you will see that it facilitates knowing where to make checksums without any compiler changes, which means that it will work with any compiler and can be applied to the binaries.
Kern On 03/07/2014 11:37 AM, Armijn Hemel wrote: > On 03/07/2014 01:32 AM, Arnt Karlsen wrote: >> ..we agree checksumming require more work to come up with a standard >> way to prove GPL etc compliance, and we agree "it can not be done >> easily right now", and we disagree "on whether it can be done at all." > > Getting checksums right every time is, as said, hard. But even if it > is possible there are some very valid use cases where this is not > desirable to have. There are compilers out there that vary the > generated byte code slightly with each compile to make it harder for > attackers to compromise programs and the binaries will have different > checksums because of that. > > There are other good ways to identify binaries and map them to source > code, at least in a way that it will be good enough for law suits (if > needed). > > armijn >
