Good article! There's still some questions to ask. I'm concerned about the safety of the evaluation of channel code. IIRC, there's no sandbox for the evaluation of package in channel. So, it's possible to inject some side-effect code into a channel like ``` (define-module (my channel code)) (display "I'm planning to do evil things here!") (define-public some-package ...) (define-public another-package ...) ``` We have PGP sign and git commit chain to make sure the commits are committed by trusted people. But it's still possible for the channel owner to inject malicious code into the channel in a future commit. Like what Marak Squires did in faker.js project :( or the committer of Guix was attacked by an evil maid. In Nix flakes, there's pure evaluation to make sure no side-effectful code is allowed. But Guix channel is less restricted than a Nix flake. It's a important problem to make sure the evaluation is safe for the user. Ludovic Courtès writes: > [[PGP Signed Part:Undecided]] > Hello Guix! > > I’m happy to announce the publication of a refereed paper in the > Programming journal: > > https://doi.org/10.22152/programming-journal.org/2023/7/1 > > It talks about the “secure update” mechanism used for channels and how > it fits together with functional deployment, reproducible builds, and > bootstrapping. Comments from reviewers showed that explaining the whole > context was important to allow people not familiar with Guix or Nix to > understand why The Update Framework (TUF) isn’t a good match, why > Git{Hub,Lab} “verified” badges aren’t any good, and so on. > > What’s presented there is not new if you’ve been following along, but > hopefully it puts things in perspective for outsiders. > > I also think that one battle here is to insist on verifiability when a > lot of work about supply chain security goes into “attestation” (with > in-toto, sigstore, Google’s SLSA, and the likes.) > > Enjoy! > > Ludo’. > > [[End of PGP Signed Part]] -- Retrieve my PGP public key: gpg --recv-keys 481F5EEEBA425ADC13247C76A6E672D981B8E744 Zihao