Post #1669959

2026-04-17 13:19 UTC

@zimoun @luj I think this is a very interesting question we should definitely go into more details, supply chain security is not only bit to bit reproducibility right? What is our threat model?

Replies (2)

@zimoun@social.sciences.re 2026-04-17 15:16

@raito Indeed there is often a mismatch between what users expect and tools tackle. I think, both Guix and Nix, are often “unclear” on this topic. Somehow, reproducible builds is maybe not the first wagon about supply chain security. Moreover, about Guix and supply chain security, I sometimes feel the same situation as 42 long and complex password written on a piece of paper close to the keyboard. 😉 @luj

Open ##1669960
@civodul@toot.aquilenet.fr 2026-04-20 20:20

@raito Supply chain security has been addressed from different angles in Guix, which I tried to explain in https://doi.org/10.22152/programming-journal.org/2023/7/1 Probably not the end of the story (we’re still tackling sometimes ridiculous issues, like avoiding “source” tarballs that contain pre-built artifacts), but a good start. @luj @zimoun

Open ##1669961