16 ms·
Not exactly a fork, and you are probably aware, but there is at least one Nix-like system with full supply chain integrity and rigid packaging standards. https
by mbakke 4y ago
Not exactly a fork, and you are probably aware, but there is at least one Nix-like system with full supply chain integrity and rigid packaging standards.
https://guix.gnu.org/en/blog/2020/securing-updates/ https://guix.gnu.org/en/blog/2020/securing-updates/
- tadfisher 4y agoAs far as I can tell, the only benefit of this scheme over content hashes and signed outputs is that Guix can serve their updates over HTTP. Otherwise it's vulnerable to the exact same scenarios as Nix: the rogue Git forge employee/maintainer can replace signatures just as easily as they can package sources.