From: Maxime Devos <maximedevos@telenet.be>
To: "Ludovic Courtès" <ludovic.courtes@inria.fr>,
"Zhu Zihao" <all_but_last@163.com>
Cc: guix-science@gnu.org, guix-devel@gnu.org
Subject: Re: “Building a Secure Software Supply Chain with GNU Guix”
Date: Tue, 19 Jul 2022 15:53:03 +0200 [thread overview]
Message-ID: <5d62345dd217d2f262b27c68f8a445bf4f959040.camel@telenet.be> (raw)
In-Reply-To: <87k08a4xmy.fsf@inria.fr>
Ludovic Courtès schreef op ma 18-07-2022 om 10:45 [+0200]:
> The model here is that users trust authorized committers. When you
> think about it, there’s no way around it, because at the end of the
> day, you’re installing software that an authorized committer added to
> the channel.
FWIW, something I haven't seen mentioned yet is that the trust problem
could be reduced by some kind of multisig system, where multiple
independent persons would need to sign the commit for it to be
accepted, though that might be technically hard to implement and
probably be too people-time-expensive currently.
Greetings,
Maxime.
next prev parent reply other threads:[~2022-07-19 14:00 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-30 14:13 “Building a Secure Software Supply Chain with GNU Guix” Ludovic Courtès
2022-06-30 21:37 ` bokr
2022-07-01 9:21 ` zimoun
2022-07-03 10:38 ` Bengt Richter
2022-07-04 8:21 ` zimoun
2022-07-04 14:56 ` Bengt Richter
2022-07-04 7:44 ` Ludovic Courtès
2022-07-17 7:54 ` Zhu Zihao
2022-07-18 8:45 ` Ludovic Courtès
2022-07-18 9:40 ` Zhu Zihao
2022-07-18 12:30 ` Ludovic Courtès
2022-07-18 12:38 ` Ricardo Wurmus
2022-07-19 13:53 ` Maxime Devos [this message]
2022-07-19 7:21 ` Arun Isaac
2022-07-19 12:11 ` Ludovic Courtès
2022-07-20 6:17 ` Arun Isaac
2022-07-19 13:45 ` Maxime Devos
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5d62345dd217d2f262b27c68f8a445bf4f959040.camel@telenet.be \
--to=maximedevos@telenet.be \
--cc=all_but_last@163.com \
--cc=guix-devel@gnu.org \
--cc=guix-science@gnu.org \
--cc=ludovic.courtes@inria.fr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).