The "substitutes" (pre-built binaries) are signed: http://www.gnu.org/software/guix/manual/html_node/Substitutes.html http://www.gnu.org/software/guix/manual/ht

The "substitutes" (pre-built binaries) are signed: http://www.gnu.org/software/guix/manual/html_node/Substitutes.html http://www.gnu.org/software/guix/manual/html_node/Substitute... . We use a SPKI-style PKI: http://www.gnu.org/software/guix/manual/html_node/Invoking-guix-archive.html http://www.gnu.org/software/guix/manual/html_node/Invoking-g... . The package recipes themselves are in a Git repo, which has signed release tags (but not signed commits.) Lastly, the new 'guix challenge' command helps users check whether binaries provided by a server genuinely come from the source it claims to have built. See http://www.gnu.org/software/guix/manual/html_node/Invoking-guix-challenge.html http://www.gnu.org/software/guix/manual/html_node/Invoking-g... .