3 ms·
The solution to this problem is not bureaucracy. The solution is in the reproducible builds project, Guix and Nix.
by ris 6y ago
The solution to this problem is not bureaucracy. The solution is in the reproducible builds project, Guix and Nix.
- Ericson2314 6y agoThe technical side of the solution is those, yes, but it's equally important that procuring administrators start requiring that level of auditability. That's the social solution. And just making the good technology is no guaranteed that society will raise its standards accordingly. Look no further than the sorry state of programming languages historically if you want proof of that...
- snicker7 6y agoThere is a big difference between Guix and Nix and this area. Guix only accepts packages that can be fully bootstrapped, unlike Nix. It's a lot more effort, but it means everything you install in the official Guix channel ultimately comes from a ~300 byte, auditable binary seed. Nix is more lenient when it comes to packages vendoring their own dependencies outside of Nix proper.