{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T19:13:21Z","timestamp":1790709201923,"version":"4.1.0"},"publisher-location":"New York, NY, USA","reference-count":48,"publisher":"ACM","license":[{"start":{"date-parts":[[2014,12,8]],"date-time":"2014-12-08T00:00:00Z","timestamp":1417996800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"FRQNT nouveau chercheur grant"},{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2014,12,8]]},"DOI":"10.1145\/2664243.2664288","type":"proceedings-article","created":{"date-parts":[[2014,12,8]],"date-time":"2014-12-08T16:30:28Z","timestamp":1418056228000},"page":"16-25","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":24,"title":["Challenges and implications of verifiable builds for security-critical open-source software"],"prefix":"10.1145","author":[{"given":"Xavier","family":"de Carn\u00e9 de Carnavalet","sequence":"first","affiliation":[{"name":"Concordia University, Montreal, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mohammad","family":"Mannan","sequence":"additional","affiliation":[{"name":"Concordia University, Montreal, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2014,12,8]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"AMD. Software optimization guide for AMD64 processors Sept. 2005.  AMD. Software optimization guide for AMD64 processors Sept. 2005."},{"key":"e_1_3_2_1_2_1","volume-title":"Oct.","year":"2013","unstructured":"Amossys. Rapport de certification DCSSI-CSPN-2013\/09 , Oct. 2013 . http:\/\/www.ssi.gouv.fr\/IMG\/cspn\/anssi-cspn_2013-09fr.pdf. Amossys. Rapport de certification DCSSI-CSPN-2013\/09, Oct. 2013. http:\/\/www.ssi.gouv.fr\/IMG\/cspn\/anssi-cspn_2013-09fr.pdf."},{"key":"e_1_3_2_1_3_1","unstructured":"Bitcoin project. Bitcoin Core 2014. https:\/\/bitcoin.org\/en\/download.  Bitcoin project. Bitcoin Core 2014. https:\/\/bitcoin.org\/en\/download."},{"key":"e_1_3_2_1_4_1","volume-title":"DebConf'13","author":"Bobbio J.","year":"2013","unstructured":"J. Bobbio . Reproducible builds for Debian . In DebConf'13 , Vaumarcus, Switzerland , Aug. 2013 . J. Bobbio. Reproducible builds for Debian. In DebConf'13, Vaumarcus, Switzerland, Aug. 2013."},{"key":"e_1_3_2_1_5_1","volume-title":"FOSDEM'14","author":"Bobbio J.","year":"2014","unstructured":"J. Bobbio . Byte-for-byte identical reproducible builds ? In FOSDEM'14 , Brussels, Belgium , Feb. 2014 . J. Bobbio. Byte-for-byte identical reproducible builds? In FOSDEM'14, Brussels, Belgium, Feb. 2014."},{"key":"e_1_3_2_1_6_1","volume-title":"Build determinism. Blog article (Oct. 17","author":"Systems Conifer","year":"2008","unstructured":"Conifer Systems . Build determinism. Blog article (Oct. 17 , 2008 ). http:\/\/www.conifersystems.com\/2008\/10\/17\/build-determinism\/. Conifer Systems. Build determinism. Blog article (Oct. 17, 2008). http:\/\/www.conifersystems.com\/2008\/10\/17\/build-determinism\/."},{"key":"e_1_3_2_1_7_1","volume-title":"Machine-independent builds. Blog article (Sept. 15","author":"Systems Conifer","year":"2008","unstructured":"Conifer Systems . Machine-independent builds. Blog article (Sept. 15 , 2008 ). http:\/\/www.conifersystems.com\/2008\/09\/15\/machine-independent-builds\/. Conifer Systems. Machine-independent builds. Blog article (Sept. 15, 2008). http:\/\/www.conifersystems.com\/2008\/09\/15\/machine-independent-builds\/."},{"key":"e_1_3_2_1_8_1","volume-title":"How I compiled TrueCrypt 7.1a for Win32 and matched the official binaries. Blog article (Oct. 21","author":"Carn\u00e9 de Carnavalet X.","year":"2013","unstructured":"X. de Carn\u00e9 de Carnavalet . How I compiled TrueCrypt 7.1a for Win32 and matched the official binaries. Blog article (Oct. 21 , 2013 ). https:\/\/madiba.encs.concordia.ca\/~x_decarn\/truecrypt-binaries-analysis\/. X. de Carn\u00e9 de Carnavalet. How I compiled TrueCrypt 7.1a for Win32 and matched the official binaries. Blog article (Oct. 21, 2013). https:\/\/madiba.encs.concordia.ca\/~x_decarn\/truecrypt-binaries-analysis\/."},{"key":"e_1_3_2_1_10_1","volume-title":"Wiki article visited on","author":"Wiki Debian","year":"2014","unstructured":"Debian Wiki . ReproducibleBuilds. Wiki article visited on May 21, 2014 . https:\/\/wiki.debian.org\/ReproducibleBuilds. Debian Wiki. ReproducibleBuilds. Wiki article visited on May 21, 2014. https:\/\/wiki.debian.org\/ReproducibleBuilds."},{"key":"e_1_3_2_1_11_1","volume-title":"Wiki article visited on","author":"Wiki Debian","year":"2014","unstructured":"Debian Wiki . SameKernel. Wiki article visited on May 21, 2014 . https:\/\/wiki.debian.org\/SameKernel. Debian Wiki. SameKernel. Wiki article visited on May 21, 2014. https:\/\/wiki.debian.org\/SameKernel."},{"key":"e_1_3_2_1_12_1","volume-title":"June","author":"Egorochkin E.","year":"2013","unstructured":"E. Egorochkin . Deterministic (bit-perfect) builds , June 2013 . nix-dev mailing list. http:\/\/lists.science.uu.nl\/pipermail\/nix-dev\/2013-June\/011357.html. E. Egorochkin. Deterministic (bit-perfect) builds, June 2013. nix-dev mailing list. http:\/\/lists.science.uu.nl\/pipermail\/nix-dev\/2013-June\/011357.html."},{"key":"e_1_3_2_1_13_1","unstructured":"Fedora Project. Reproducible builds for Fedora. https:\/\/github.com\/kholia\/ReproducibleBuilds.  Fedora Project. Reproducible builds for Fedora. https:\/\/github.com\/kholia\/ReproducibleBuilds."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.5555\/822075.822408"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1900546.1900550"},{"key":"e_1_3_2_1_16_1","author":"Gallagher R.","year":"2014","unstructured":"R. Gallagher and G. Greenwald . How the NSA plans to infect 'millions' of computers with malware. News article ( Mar. 12, 2014 ). https:\/\/firstlook.org\/theintercept\/article\/2014\/03\/12\/nsa-plans-infect-millions-computers-malware\/. R. Gallagher and G. Greenwald. How the NSA plans to infect 'millions' of computers with malware. News article (Mar. 12, 2014). https:\/\/firstlook.org\/theintercept\/article\/2014\/03\/12\/nsa-plans-infect-millions-computers-malware\/.","journal-title":"News article"},{"key":"e_1_3_2_1_17_1","volume-title":"Oct.","year":"2009","unstructured":"Gitian.org. Gitian: a secure software distribution method , Oct. 2009 . Gitian.org. Gitian: a secure software distribution method, Oct. 2009."},{"key":"e_1_3_2_1_18_1","unstructured":"GnuWin project. CoreUtils and gzip for Windows. http:\/\/sourceforge.net\/projects\/gnuwin32\/.  GnuWin project. CoreUtils and gzip for Windows. http:\/\/sourceforge.net\/projects\/gnuwin32\/."},{"key":"e_1_3_2_1_19_1","unstructured":"J. Gordon. The RSDS pdb format 2010. http:\/\/www.godevtool.com\/Other\/pdb.htm.  J. Gordon. The RSDS pdb format 2010. http:\/\/www.godevtool.com\/Other\/pdb.htm."},{"key":"e_1_3_2_1_20_1","volume-title":"Gadget' in the middle: Flame malware spreading vector identified. Blog article (June 4","author":"Gostev A.","year":"2012","unstructured":"A. Gostev . ' Gadget' in the middle: Flame malware spreading vector identified. Blog article (June 4 , 2012 ). https:\/\/securelist.com\/blog\/incidents\/33081\/gadget-in-the-middle-flame-malware-spreading-vector-identified-22\/. A. Gostev. 'Gadget' in the middle: Flame malware spreading vector identified. Blog article (June 4, 2012). https:\/\/securelist.com\/blog\/incidents\/33081\/gadget-in-the-middle-flame-malware-spreading-vector-identified-22\/."},{"key":"e_1_3_2_1_21_1","volume-title":"Feb.","year":"2012","unstructured":"Hex-Rays.com. Fast library identification and recognition technology , Feb. 2012 . https:\/\/www.hex-rays.com\/products\/ida\/tech\/flirt\/index.shtml. Hex-Rays.com. Fast library identification and recognition technology, Feb. 2012. https:\/\/www.hex-rays.com\/products\/ida\/tech\/flirt\/index.shtml."},{"key":"e_1_3_2_1_22_1","unstructured":"IEEE and The Open Group. dd. The Open Group Base Specifications Issue 7.  IEEE and The Open Group. dd. The Open Group Base Specifications Issue 7."},{"key":"e_1_3_2_1_23_1","volume-title":"Feb.","year":"2014","unstructured":"Intel. Intel 64 and IA-32 architectures software developer's manual , Feb. 2014 . Intel. Intel 64 and IA-32 architectures software developer's manual, Feb. 2014."},{"key":"e_1_3_2_1_24_1","unstructured":"iSEC. Open Crypto Audit Project - TrueCrypt - Security assessment Apr. 2014.  iSEC. Open Crypto Audit Project - TrueCrypt - Security assessment Apr. 2014."},{"key":"e_1_3_2_1_25_1","volume-title":"USENIX LEET'08","author":"King S. T.","year":"2008","unstructured":"S. T. King , J. Tucek , A. Cozzie , C. Grier , W. Jiang , and Y. Zhou . Designing and implementing malicious hardware . In USENIX LEET'08 , San Francisco, CA, USA , Aug. 2008 . S. T. King, J. Tucek, A. Cozzie, C. Grier, W. Jiang, and Y. Zhou. Designing and implementing malicious hardware. In USENIX LEET'08, San Francisco, CA, USA, Aug. 2008."},{"key":"e_1_3_2_1_26_1","volume-title":"Sept.","author":"Kirsch H.","year":"2013","unstructured":"H. Kirsch . The theory of build systems , Sept. 2013 . http:\/\/www.pifpafpuf.de\/BuildTheory.html. H. Kirsch. The theory of build systems, Sept. 2013. http:\/\/www.pifpafpuf.de\/BuildTheory.html."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.25"},{"key":"e_1_3_2_1_28_1","volume-title":"Past performance is no guarantee of future results. Blog article (May 31","author":"Lippert E.","year":"2012","unstructured":"E. Lippert . Past performance is no guarantee of future results. Blog article (May 31 , 2012 ). http:\/\/ericlippert.com\/2012\/05\/31\/past-performance-is-no-guarantee-of-future-results\/. E. Lippert. Past performance is no guarantee of future results. Blog article (May 31, 2012). http:\/\/ericlippert.com\/2012\/05\/31\/past-performance-is-no-guarantee-of-future-results\/."},{"key":"e_1_3_2_1_29_1","volume-title":"Exclusive: NSA infiltrated RSA security more deeply than thought - study","author":"Menn J.","year":"2014","unstructured":"J. Menn . Exclusive: NSA infiltrated RSA security more deeply than thought - study . Reuters news article ( Mar. 31, 2014 ). http:\/\/www.reuters.com\/article\/2014\/03\/31\/us-usa-security-nsa-rsa-idUSBREA2U0TY20140331. J. Menn. Exclusive: NSA infiltrated RSA security more deeply than thought - study. Reuters news article (Mar. 31, 2014). http:\/\/www.reuters.com\/article\/2014\/03\/31\/us-usa-security-nsa-rsa-idUSBREA2U0TY20140331."},{"key":"e_1_3_2_1_30_1","volume-title":"Microsoft Portable Executable and Common Object File Format specification v8.3","year":"2013","unstructured":"Microsoft. Microsoft Portable Executable and Common Object File Format specification v8.3 , 2013 . Microsoft. Microsoft Portable Executable and Common Object File Format specification v8.3, 2013."},{"key":"e_1_3_2_1_31_1","volume-title":"Profile-guided optimizations","year":"2013","unstructured":"Microsoft. Profile-guided optimizations , 2013 . http:\/\/msdn.microsoft.com\/en-us\/library\/vstudio\/e7k32f4k.aspx. Microsoft. Profile-guided optimizations, 2013. http:\/\/msdn.microsoft.com\/en-us\/library\/vstudio\/e7k32f4k.aspx."},{"key":"e_1_3_2_1_32_1","volume-title":"Specify symbol (.pdb) and source files in the Visual Studio Debugger","year":"2013","unstructured":"Microsoft. Specify symbol (.pdb) and source files in the Visual Studio Debugger , 2013 . http:\/\/msdn.microsoft.com\/en-us\/library\/ms241613.aspx. Microsoft. Specify symbol (.pdb) and source files in the Visual Studio Debugger, 2013. http:\/\/msdn.microsoft.com\/en-us\/library\/ms241613.aspx."},{"key":"e_1_3_2_1_33_1","volume-title":"Aug.","author":"Network Mozilla Developer","year":"2013","unstructured":"Mozilla Developer Network . Building with profile-guided optimization , Aug. 2013 . https:\/\/developer.mozilla.org\/en\/docs\/Building_with_Profile-Guided_Optimization. Mozilla Developer Network. Building with profile-guided optimization, Aug. 2013. https:\/\/developer.mozilla.org\/en\/docs\/Building_with_Profile-Guided_Optimization."},{"key":"e_1_3_2_1_34_1","unstructured":"openSUSE Build Service. Build result compare script. https:\/\/build.opensuse.org\/package\/show\/openSUSE:Factory\/build-compare.  openSUSE Build Service. Build result compare script. https:\/\/build.opensuse.org\/package\/show\/openSUSE:Factory\/build-compare."},{"key":"e_1_3_2_1_35_1","volume-title":"Deterministic builds part one: Cyberwar and global compromise. Tor Project article (Aug. 20","author":"Perry M.","year":"2013","unstructured":"M. Perry . Deterministic builds part one: Cyberwar and global compromise. Tor Project article (Aug. 20 , 2013 ). https:\/\/blog.torproject.org\/blog\/deterministic-builds-part-one-cyberwar-and-global-compromise. M. Perry. Deterministic builds part one: Cyberwar and global compromise. Tor Project article (Aug. 20, 2013). https:\/\/blog.torproject.org\/blog\/deterministic-builds-part-one-cyberwar-and-global-compromise."},{"key":"e_1_3_2_1_36_1","volume-title":"Blog article (Nov. 11","author":"Pistelli D.","year":"2010","unstructured":"D. Pistelli . Microsoft's Rich signature (undocumented). Blog article (Nov. 11 , 2010 ). http:\/\/www.ntcore.com\/files\/richsign.htm. D. Pistelli. Microsoft's Rich signature (undocumented). Blog article (Nov. 11, 2010). http:\/\/www.ntcore.com\/files\/richsign.htm."},{"key":"e_1_3_2_1_37_1","volume-title":"Analysis: Is there a backdoor in Truecrypt? Is Truecrypt a CIA honeypot? Blog article (Aug. 14","year":"2010","unstructured":"PrivacyLover.com. Analysis: Is there a backdoor in Truecrypt? Is Truecrypt a CIA honeypot? Blog article (Aug. 14 , 2010 ). http:\/\/www.privacylover.com\/. PrivacyLover.com. Analysis: Is there a backdoor in Truecrypt? Is Truecrypt a CIA honeypot? Blog article (Aug. 14, 2010). http:\/\/www.privacylover.com\/."},{"key":"e_1_3_2_1_38_1","volume-title":"Dec.","author":"Infrastructure Services SOGETI","year":"2008","unstructured":"SOGETI Infrastructure Services . Rapport de certification DCSSI-CSPN-2008\/03 , Dec. 2008 . http:\/\/www.ssi.gouv.fr\/IMG\/cspn\/dcssi-cspn_2008-03fr.pdf. SOGETI Infrastructure Services. Rapport de certification DCSSI-CSPN-2008\/03, Dec. 2008. http:\/\/www.ssi.gouv.fr\/IMG\/cspn\/dcssi-cspn_2008-03fr.pdf."},{"key":"e_1_3_2_1_39_1","volume-title":"Nov.","year":"2012","unstructured":"StackOverflow.com. How do I build TrueCrypt on Windows? , Nov. 2012 . http:\/\/stackoverflow.com\/questions\/13379644\/how-do-i-build-truecrypt-on-windows\/13414137#13414137. StackOverflow.com. How do I build TrueCrypt on Windows?, Nov. 2012. http:\/\/stackoverflow.com\/questions\/13379644\/how-do-i-build-truecrypt-on-windows\/13414137#13414137."},{"key":"e_1_3_2_1_40_1","volume-title":"NASM crashes when building x64 .obj file. Bug ticket (Oct. 6","author":"The Netwide","year":"2009","unstructured":"The Netwide Assembler bug tracking system. NASM crashes when building x64 .obj file. Bug ticket (Oct. 6 , 2009 ). http:\/\/sourceforge.net\/p\/nasm\/bugs\/469\/. The Netwide Assembler bug tracking system. NASM crashes when building x64 .obj file. Bug ticket (Oct. 6, 2009). http:\/\/sourceforge.net\/p\/nasm\/bugs\/469\/."},{"key":"e_1_3_2_1_41_1","volume-title":"Mar.","author":"Team The","year":"2003","unstructured":"The PaX Team . Address space layout randomization , Mar. 2003 . http:\/\/pax.grsecurity.net\/docs\/aslr.txt. The PaX Team. Address space layout randomization, Mar. 2003. http:\/\/pax.grsecurity.net\/docs\/aslr.txt."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/358198.358210"},{"key":"e_1_3_2_1_43_1","volume-title":"Improve software assurance. Bug ticket (May 31","author":"Tor Project","year":"2012","unstructured":"Tor Project bug track system. Improve software assurance. Bug ticket (May 31 , 2012 ). https:\/\/trac.torproject.org\/projects\/tor\/ticket\/6008. Tor Project bug track system. Improve software assurance. Bug ticket (May 31, 2012). https:\/\/trac.torproject.org\/projects\/tor\/ticket\/6008."},{"key":"e_1_3_2_1_44_1","unstructured":"TrueCrypt Foundation. TrueCrypt.  TrueCrypt Foundation. TrueCrypt."},{"key":"e_1_3_2_1_45_1","volume-title":"Security analysis of TrueCrypt 7.0a with an attack on the keyfile algorithm. Technical report (Aug. 14","author":"Remix Team Ubuntu Privacy","year":"2011","unstructured":"Ubuntu Privacy Remix Team . Security analysis of TrueCrypt 7.0a with an attack on the keyfile algorithm. Technical report (Aug. 14 , 2011 ). https:\/\/www.privacy-cd.org\/downloads\/truecrypt_7.0a-analysis-en.pdf. Ubuntu Privacy Remix Team. Security analysis of TrueCrypt 7.0a with an attack on the keyfile algorithm. Technical report (Aug. 14, 2011). https:\/\/www.privacy-cd.org\/downloads\/truecrypt_7.0a-analysis-en.pdf."},{"key":"e_1_3_2_1_46_1","unstructured":"M. Uecker. Building packages three times in a row. Debian mailing list. https:\/\/lists.debian.org\/debian-devel\/2007\/09\/msg00746.html.  M. Uecker. Building packages three times in a row. Debian mailing list. https:\/\/lists.debian.org\/debian-devel\/2007\/09\/msg00746.html."},{"key":"e_1_3_2_1_47_1","volume-title":"Mar.","author":"Walton J.","year":"2008","unstructured":"J. Walton . An analysis of the Windows PE checksum algorithm , Mar. 2008 . http:\/\/www.codeproject.com\/Articles\/19326\/An-Analysis-of-the-Windows-PE-Checksum-Algorithm. J. Walton. An analysis of the Windows PE checksum algorithm, Mar. 2008. http:\/\/www.codeproject.com\/Articles\/19326\/An-Analysis-of-the-Windows-PE-Checksum-Algorithm."},{"key":"e_1_3_2_1_48_1","volume-title":"USENIX Annual Technical Conference","author":"Wendlandt D.","year":"2008","unstructured":"D. Wendlandt , D. G. Andersen , and A. Perrig . Perspectives: Improving SSH-style host authentication with multi-path probing . In USENIX Annual Technical Conference , Boston, MA, USA , June 2008 . D. Wendlandt, D. G. Andersen, and A. Perrig. Perspectives: Improving SSH-style host authentication with multi-path probing. In USENIX Annual Technical Conference, Boston, MA, USA, June 2008."},{"key":"e_1_3_2_1_49_1","volume-title":"George Mason University","author":"Wheeler D. A.","year":"2009","unstructured":"D. A. Wheeler . Fully Countering Trusting Trust through Diverse Double-Compiling. PhD thesis , George Mason University , Oct. 2009 . D. A. Wheeler. Fully Countering Trusting Trust through Diverse Double-Compiling. PhD thesis, George Mason University, Oct. 2009."}],"event":{"name":"ACSAC '14: Annual Computer Security Applications Conference","location":"New Orleans Louisiana USA","acronym":"ACSAC '14","sponsor":["ACSA Applied Computing Security Assoc"]},"container-title":["Proceedings of the 30th Annual Computer Security Applications Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2664243.2664288","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2664243.2664288","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T06:12:02Z","timestamp":1750227122000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2664243.2664288"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,12,8]]},"references-count":48,"alternative-id":["10.1145\/2664243.2664288","10.1145\/2664243"],"URL":"https:\/\/doi.org\/10.1145\/2664243.2664288","relation":{},"subject":[],"published":{"date-parts":[[2014,12,8]]},"assertion":[{"value":"2014-12-08","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}