Post #1669961
2026-04-20 20:20 UTC
@raito Supply chain security has been addressed from different angles in Guix, which I tried to explain in https://doi.org/10.22152/programming-journal.org/2023/7/1
Probably not the end of the story (we’re still tackling sometimes ridiculous issues, like avoiding “source” tarballs that contain pre-built artifacts), but a good start.
@luj @zimoun
Replies (1)
-
@raito@nixos.paris 2026-04-21 11:31
@civodul @luj @zimoun I skimmed through the paper but I did not find what I was interested in. How do you address the committer trust layer? I get that Guix authenticates Git checkouts and verifies signatures of committers. How does Guix work towards coercion resistance against backdooring, suspicious behavioral attacks, compromised forge accounts/authoring systems, etc. ? I suspect this is the point that has been the least addressed among all modern supply chain solutions.