7 ms·
A couple days ago an HN commenter suggested that use of Alpine is by definition a supply-chain security problem: > "Alpine is not full-source-bootstrapped, oft
by chrisweekly 3y ago
A couple days ago an HN commenter suggested that use of Alpine is by definition a supply-chain security problem:
> "Alpine is not full-source-bootstrapped, often imports and trusts external binaries blindly, has no signed commits, no signed reviews, no signed packages, and is not reproducible. It is one phished git account away from a major supply chain attack any day now.
Alpine chooses low security for low contribution friction. It is the Wikipedia of Linux distros, which granted it a huge package repository fantastic for experimental use and reference, but it is not something sane to blindly trust the latest packages of in production."
I'd be grateful to hear other expert opinions.
- fullspectrumdev 3y agoGetting all those things right costs money to pay developers. Alpine aren’t exactly drowning in money, despite so much container shit being built off their backs.
- DEADMINCE 3y ago> Alpine is not full-source-bootstrapped, often imports and trusts external binaries blindly, has no signed commits, no signed reviews, no signed packages, and is not reproducible. Are Void or Chimera any better?
- q66 3y agothe above is not entirely correct, alpine does have and always had signed packages in the other aspects most distros are generally not much or at all better, since all that stuff is hard and takes extra infrastructure in chimera we try to make source bootstrap possible and in general not rely on third party executables, but it's not always possible (e.g. some language toolchains were bootstrapped from official binaries originally) and we try to respect best practices for reproducibility (pretty sure alpine does too) but actually verifying it would need dedicated infra/resources, so we don't do it