4 ms·

For those looking for alternatives to the status quo on Linux supply chain security, check out [Stageˣ]. It is 100% deterministic, hermetic, and reproducible.

by lrvick 2y ago

For those looking for alternatives to the status quo on Linux supply chain security, check out [Stageˣ]. It is 100% deterministic, hermetic, and reproducible. Also it is full source bootstrapped from 180 bytes of human-auditable machine code, all released artifacts are multi-party reproduced/reviewed/signed, and it is fully container-native all the way down "FROM scratch" making it easy to pin dependency hashes to reproduce your own projects with it. I started it after years of unsuccessful pleading with existing distros to stop giving ultimate solitary trust to -any- maintainers or sysadmins involved in the project. https://codeberg.org/stagex/stagex https://codeberg.org/stagex/stagex

noman-land 2y ago
Pardon my naivete but I've heard Nix described in many of the same terms. What are the differences and similarities between Stageˣ and Nix/NixOS?
- lrvick 2y ago
  I am obviously pretty biased having authored a failed RFC to Nix to mandate signing, and having founded StageX, but here goes. Unlike StageX, Nix has a wikipedia-style low friction approach to packaging allowing a large community to maintain a huge number of packages which are signed by a central trusted party, while being -mostly- reproducible. It relies on a custom language and toolchain for packaging. Nix is designed for hobbyists seeking to reproduce their own workstations. Unlike Nix, StageX is 100% reproducible and all changes are independently signed by authors and reviewers, then artifacts are reproduced and signed by multiple distributed maintainers. It is also full source bootstrapped, and is built on the broadly compatible OCI standard for packaging. StageX is designed for production threat models where only compiler and infrastructure toolchains are needed and trusting any single person is unacceptable. One maintainer even uses Nix as a workstation to contribute to StageX. They have fundamentally different goals and use cases.
green7ea 2y ago
This project looks amazing — I didn't think bootstrapping like this was possible. Kudos on the project :-). This might displace chainguard as my goto docker images :-).

by lrvick 2y ago

noman-land 2y ago

Pardon my naivete but I've heard Nix described in many of the same terms. What are the differences and similarities between Stageˣ and Nix/NixOS?

lrvick 2y ago
I am obviously pretty biased having authored a failed RFC to Nix to mandate signing, and having founded StageX, but here goes. Unlike StageX, Nix has a wikipedia-style low friction approach to packaging allowing a large community to maintain a huge number of packages which are signed by a central trusted party, while being -mostly- reproducible. It relies on a custom language and toolchain for packaging. Nix is designed for hobbyists seeking to reproduce their own workstations. Unlike Nix, StageX is 100% reproducible and all changes are independently signed by authors and reviewers, then artifacts are reproduced and signed by multiple distributed maintainers. It is also full source bootstrapped, and is built on the broadly compatible OCI standard for packaging. StageX is designed for production threat models where only compiler and infrastructure toolchains are needed and trusting any single person is unacceptable. One maintainer even uses Nix as a workstation to contribute to StageX. They have fundamentally different goals and use cases.

green7ea 2y ago

This project looks amazing — I didn't think bootstrapping like this was possible. Kudos on the project :-). This might displace chainguard as my goto docker images :-).