Post #1669950
2026-04-17 11:04 UTC
Replies (3)
-
@zimoun@social.sciences.re 2026-04-17 11:05
The politics of language design by Pierre-Étienne Meunier in #LixCon2026 « Fake supply chain security, even worse than no supply chain security at all? » …Yeah: 2. Guix/Nix packages stuff: it means it provides tooling for auditing and verifying if the binary matches the identified source; and for the whole chain of dependencies. But there is no guarantee it’s fully error-free – we’re able to point where the error if any comes from. It’s already a lot! Guix is like the indian Dabbawala service using “barecodes” everywhere. It doesn’t prevent stories as The Lunchbox. 😉 https://en.wikipedia.org/wiki/Dabbawala https://en.wikipedia.org/wiki/The_Lunchbox 4/6
-
@raito@nixos.paris 2026-04-17 13:19
@zimoun @luj I think this is a very interesting question we should definitely go into more details, supply chain security is not only bit to bit reproducibility right? What is our threat model?
-
@civodul@toot.aquilenet.fr 2026-04-20 20:15
@zimoun Build reproducibility is monitored per package, per commit, and per architecture, and all that is stored in the Data Service. We can get a glimpse of it at https://qa.guix.gnu.org/branch/master The downside is that there’s currently “only” two build farms to compare. @luj