Re: P2P Guix package building and distribution

[Samuel Christie via "Development of GNU Guix and the GNU System distribution." <guix-devel@gnu.org>]

Andreas Enge <andreas@enge.fr> writes: 
> Am Wed, Aug 21, 2024 at 06:07:58PM -0400 schrieb Christine 
> Lemmer-Webber: 
>> Okay, but what if instead I had the option to download 
>> something signed off by *all of* the MegaCloud build service 
>> and two "Guix Builders", and they all came to the same hash?
>
> Would this not suppose that all these build instances are 
> completely disjoint from each other (like bordeaux or ci), and 
> thus will have to build everything from scratch? Since if a 
> "Guix Builder" uses a MegaCloud input, every build from then on 
> is no more secure than a MegaCloud build.

Yes; every step needs to be validated to ensure the final result 
is correct. That doesn't mean all builders need to validate the 
full tree, just one non-colluding party for each output.

Maybe one solution is to have the community perform the primary 
builds, with "official" builders arbitrating when there's a 
disagreement over the hash. As long as each package is built by at 
least one non-colluding peer, any deviations will be caught. This 
would be simpler than a full consensus protocol, but still avoid 
most conflicts and ensure correctness. Repeat offenders should 
eventually be ignored or banned somehow, but in the worst case it 
devolves to the system we have now of official servers building 
everything.

> Given the effort (in money and administrators' time) to run one 
> build farm, it does not look realistic that several people start 
> their own build farm at home.

Ideally, the software would be as simple as turning on a service 
to participate. And they shouldn't have to be "full" build farms, 
just share some of the load.

Since packages are already built locally if no substitutes are
available, it might be interesting to simply let the first few computers
that install the package build and share it. Then only ~2 people have to
build new packages (for minimal verification) instead of making everyone
do it until an official substitute exists.