4 ms·
They are efforts underway. Look in to content-addressed-nix and Trustix. But the way I understand it, the current trust model is no different than any other pa
by hamandcheese 3y ago
They are efforts underway. Look in to content-addressed-nix and Trustix.
But the way I understand it, the current trust model is no different than any other package manager, so this hardly seems like a fair criticism.
- lrvick 3y agoTrustix and CAN are -fantastic- for the problems they are intended to solve, but they only cover the consumption side of the supply chain. You can use these to ensure the binaries are built from the published code, or that you are using the right published code. You have no idea if the published git commits were not made by a sim swap compromised github account... because maintainers are not required to do the bare minimum such as signing commits. Compare to arch, fedora, debian, and basically every other linux distro that has existed more than a decade. Every maintainer signs their own contributions with well known keys so they cannot be impersonated and so later stages of the supply chain cannot tamper with them. Newer distros like Nix and Alpine decided do get rid of all that security overhead in order to attract a huge pile of randos as maintainers. I mean, it worked, but at a very high price.
- hamandcheese 3y agoI see. Yes, that is a bit disappointing.