Re: security concerns of using guix packages

[John Darrington <john@darrington.wattle.id.au>]

[-- Attachment #1: Type: text/plain, Size: 1631 bytes --]

On Fri, Jul 03, 2015 at 12:38:49AM +0000, Cook, Malcolm wrote:
     Hello Guixen (Guixers?  Guix-noscenti?)
     
     The sys admin at my institute expresses concern that we would potentially expose ourselves to additional security risk by building scientific software stack in Guix where we might depend on alternate versions of, say, openssl.
     
     Do you agree this is a reasonable concern, and, if so, is there a "position statement" on the matter?  
     
     I'm guessing this is in part a matter of trust - i.e. do we trust GNU/guix gang as much as, say the Red Hat/CentOS gang.  Or am I perhaps misunderstanding the consideration?
     
     
When you install (say Redhat), like you say, you have to trust that Redhat 
hasn't (deliberately or maliciously) put malware into any of the MANY THOUSAND 
binaries that make up the OS.

When you install Guix, you have to trust that Guix hasn't put malware into any 
of the FIVE bootstrap binaries.  If you trust these five binaries, then you can 
do one of two things:

1.  Build everything else from source.  That way you know they are kosher,
    because you built it.  This can be done automatically, but takes rather
    a long time.

2.  Choose to trust the server at hydra.gnu.org, and have Guix download
    "substitutes".  This is a lot quicker, but you have to trust that
    the people who control that server haven't inserted malware. 



J'


     

-- 
PGP Public key ID: 1024D/2DE827B3 
fingerprint = 8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 198 bytes --]