From: Mike Gerwitz <mtg@gnu.org>
To: Pjotr Prins <pjotr.public12@thebird.nl>
Cc: guix-devel <guix-devel@gnu.org>
Subject: Re: NPM and trusted binaries
Date: Wed, 07 Sep 2016 22:45:46 -0400 [thread overview]
Message-ID: <87bmzzkt2d.fsf@gnu.org> (raw)
In-Reply-To: <20160906165048.GC18454@thebird.nl> (Pjotr Prins's message of "Tue, 6 Sep 2016 18:50:48 +0200")
[-- Attachment #1: Type: text/plain, Size: 908 bytes --]
On Tue, Sep 06, 2016 at 18:50:48 +0200, Pjotr Prins wrote:
> On Tue, Sep 06, 2016 at 11:48:04AM -0400, Thompson, David wrote:
>> This violates a core principle of Guix: reproducible builds. I don't
>> support patches that encourage using pre-built binaries.
>
> In principle I agree. We want to be able to read the code.
>
> Still, I think Guix would benefit from a somewhat more relaxed stance
> in this.
If a user is able to build from source, shouldn't Guix be able to? And
if neither can, how can we guarantee that the provided binary is even
free and actually corresponds to the given source?
From a software freedom perspective, the source code _is_ the
program. If that is unworkable, then so is the software itself.
--
Mike Gerwitz
Free Software Hacker+Activist | GNU Maintainer & Volunteer
GPG: 2217 5B02 E626 BC98 D7C0 C2E5 F22B B815 8EE3 0EAB
https://mikegerwitz.com
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]
next prev parent reply other threads:[~2016-09-08 2:49 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-23 9:07 GSoC NPM Jelle Licht
2016-08-25 10:24 ` Ricardo Wurmus
2016-08-27 13:12 ` Jelle Licht
2016-09-06 23:21 ` Catonano
2016-08-27 21:43 ` Ludovic Courtès
2016-09-06 20:00 ` Christopher Allan Webber
2016-09-02 14:24 ` Jan Nieuwenhuizen
2016-09-02 15:27 ` Thompson, David
2016-09-02 16:23 ` Jan Nieuwenhuizen
2016-09-02 15:33 ` Jelle Licht
2016-09-04 14:11 ` Jan Nieuwenhuizen
2016-09-06 15:48 ` Thompson, David
2016-09-06 16:50 ` NPM and trusted binaries Pjotr Prins
2016-09-07 12:25 ` Ludovic Courtès
2016-09-07 17:51 ` Jan Nieuwenhuizen
2016-09-08 7:01 ` Pjotr Prins
2016-09-08 8:29 ` Jelle Licht
2016-09-08 2:45 ` Mike Gerwitz [this message]
2016-09-08 8:45 ` Jan Nieuwenhuizen
2016-09-08 17:31 ` Mike Gerwitz
2016-09-08 19:54 ` Jan Nieuwenhuizen
2016-09-09 0:31 ` Mike Gerwitz
2016-09-09 8:45 ` Ludovic Courtès
2016-09-09 9:26 ` Pjotr Prins
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87bmzzkt2d.fsf@gnu.org \
--to=mtg@gnu.org \
--cc=guix-devel@gnu.org \
--cc=pjotr.public12@thebird.nl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).