4 ms·

But that SHA hash of the built artifact doesn't go in the package recipe. So how do I know what the SHA hash of the built artifact should be, if all I have is t

by catern 5y ago

But that SHA hash of the built artifact doesn't go in the package recipe. So how do I know what the SHA hash of the built artifact should be, if all I have is the Guix repo? I can always rebuild the artifacts myself using "challenge", but that defeats the purpose of using the substitute server...

mbakke 5y ago
It means that if a server on your LAN advertises a substitute for a derivation that is bit-identical with one that is signed by an authorized substitute server (such as ci.guix.gnu.org), the build output will be downloaded from your network neighbor instead of over the internet. Of course this requires that ci.guix.gnu.org has already built the same derivation.
- catern 5y ago
  Ah, thanks, makes sense! So it's just a bandwidth-saving device - still, sounds quite useful.
  - medstrom 5y ago
    It opens the door for more peer-to-peer distribution in the future. Imagine if every Guix system published their builds (as an opt-out setting). Then even if you modify a package's build options, a few other people might have made the exact same modification and you can download the built artifact from them.
    - catern 5y ago
      No, because then you have to trust those other people to not build the package maliciously.
      - medstrom 5y ago
        Sure, but what's the likelihood they're all compromised? Let's say 3 people have to build it (and publish the hash) before your client will download from one of them.