2 ms·
This still doesn't fix the "trusting trust" attack: which Guix actually can, and which can bootstrap sideways to build other distros. It also doesn't do anythi
by XorNot 1y ago
This still doesn't fix the "trusting trust" attack: which Guix actually can, and which can bootstrap sideways to build other distros.
It also doesn't do anything which regular packaging systems don't (nix does have some interesting qualities, security ain't one of them): I.e. that big list of dependencies isn't automatic in any way, someone had to write them, which in turn makes it exactly the same as any other packaging systems build-deps.
- christophilus 1y agoHow does guix fix the trusting trust attack? Aside: I wonder if AI code inspection and review could be put in place to detect xz-like malicious changes to the supply chain for major distros.
- CBLT 1y agohttps://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/ https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-... Guix bootstraps (in 2023, no clue about now) from a 357-byte program. You audit the bytecode.