unofficial mirror of 
 help / color / Atom feed
From: zimoun <>
To: "Ludovic Courtès" <>
Cc: Guix Devel <>
Subject: Re: Securing the software distribution chain
Date: Mon, 27 Jul 2020 20:13:39 +0200
Message-ID: <> (raw)
In-Reply-To: <>


On Mon, 27 Jul 2020 at 14:54, Ludovic Courtès <> wrote:

> Of course we could have additional tools to make use of that info, say
> ‘guix build -S --authenticate’ or something.  But that would still be
> optional.

What do you mean?

The command "guix build -S" returns the tarball (where non-free code
is removed).  Therefore, this hypothetical and optional
"--authenticate" would authenticate against who?  The user who runs
the command; well I am not sure it is an useful use-case.  The build
farm which would authenticate substitutes, but the commits are already
signed so it would not add some trust

> Note that ‘guix refresh -u’ and ‘guix import gnu’ (and maybe other
> importers too?) take care of tarball authentication already.  ‘guix
> download’ could share part of the mechanism.  I agree it would be nice.


> On a related note, and perhaps that’s what you mean by “parts of the
> artifact changing”, see the discussion on authenticating source code
> archived at Software Heritage:
> Content-addressing is nice, but not very useful if each tool (IPFS, SWH,
> Git, Guix) has its own way to address content…

Well, the challenge seems here.  First transition from url-fetch
signed tarballs to authenticable content-addressed code such as signed
git-fetch and second be able to bridge the different address contents.
Or let fall in the trap [1]. :-)


All the best,

  reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-23 11:07 Justus Winter
2020-07-27 12:53 ` Ludovic Courtès
2020-07-27 18:13   ` zimoun [this message]
2020-07-31  9:20   ` Justus Winter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

  List information:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

unofficial mirror of 

Archives are clonable:
	git clone --mirror guix-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 guix-devel guix-devel/ \
	public-inbox-index guix-devel

Example config snippet for mirrors

Newsgroups are available over NNTP:

AGPL code for this site: git clone