Re: “Building a Secure Software Supply Chain with GNU Guix”

[Zhu Zihao <all_but_last@163.com>]

[-- Attachment #1: Type: text/plain, Size: 2203 bytes --]


Good article!

There's still some questions to ask. I'm concerned about the safety of
the evaluation of channel code. IIRC, there's no sandbox for the
evaluation of package in channel. So, it's possible to inject some
side-effect code into a channel like

```
(define-module (my channel code))

(display "I'm planning to do evil things here!")

(define-public some-package ...)
(define-public another-package ...)
```

We have PGP sign and git commit chain to make sure the commits are
committed by trusted people. But it's still possible for the channel
owner to inject malicious code into the channel in a future commit. Like
what Marak Squires did in faker.js project :( or the committer of Guix
was attacked by an evil maid.

In Nix flakes, there's pure evaluation to make sure no side-effectful
code is allowed. But Guix channel is less restricted than a Nix flake.
It's a important problem to make sure the evaluation is safe for the user.


Ludovic Courtès <ludovic.courtes@inria.fr> writes:

> [[PGP Signed Part:Undecided]]
> Hello Guix!
>
> I’m happy to announce the publication of a refereed paper in the
> Programming journal:
>
>   https://doi.org/10.22152/programming-journal.org/2023/7/1
>
> It talks about the “secure update” mechanism used for channels and how
> it fits together with functional deployment, reproducible builds, and
> bootstrapping.  Comments from reviewers showed that explaining the whole
> context was important to allow people not familiar with Guix or Nix to
> understand why The Update Framework (TUF) isn’t a good match, why
> Git{Hub,Lab} “verified” badges aren’t any good, and so on.
>
> What’s presented there is not new if you’ve been following along, but
> hopefully it puts things in perspective for outsiders.
>
> I also think that one battle here is to insist on verifiability when a
> lot of work about supply chain security goes into “attestation” (with
> in-toto, sigstore, Google’s SLSA, and the likes.)
>
> Enjoy!
>
> Ludo’.
>
> [[End of PGP Signed Part]]


-- 
Retrieve my PGP public key:

  gpg --recv-keys 481F5EEEBA425ADC13247C76A6E672D981B8E744

Zihao

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 255 bytes --]