this post was submitted on 25 Jan 2024
119 points (98.4% liked)
Open Source
30923 readers
156 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
- !libre_culture@lemmy.ml
- !libre_software@lemmy.ml
- !libre_hardware@lemmy.ml
- !linux@lemmy.ml
- !technology@lemmy.ml
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Unless the dependencies they compile in have reproducible builds set up, then you literally cannot expect binaries to compile the same bit-for-bit between different build environments. This is a known problem for tons of reasons, etc etc. Progress has been made on improving build practices, but there are still tons of projects that aren't reproducible. Also, the checksums not matching could easily be caused by Ventoy developers enabling different compile-time flags on their builds than upstream builds, which is near the top of the list of reasons why you'd bother to provide your own builds to start with. There are literally like 500 legitimate reasons why their builds might have different checksums than upstream's builds. Your accusation is nonsense unless you can do some more digging and prove there are unpublished modifications to their dependencies.