From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: Preparing the reduced bootstrap tarballs Date: Sat, 17 Nov 2018 18:14:45 -0500 Message-ID: <87bm6nwb27.fsf@netris.org> References: <87d0r322zy.fsf@ITSx01.pdp10.guru> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:59631) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gO9oK-0006fA-2f for guix-devel@gnu.org; Sat, 17 Nov 2018 18:15:33 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gO9oF-0002tK-61 for guix-devel@gnu.org; Sat, 17 Nov 2018 18:15:32 -0500 Received: from world.peace.net ([64.112.178.59]:39130) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gO9oF-0002t3-2r for guix-devel@gnu.org; Sat, 17 Nov 2018 18:15:27 -0500 In-Reply-To: <87d0r322zy.fsf@ITSx01.pdp10.guru> (Jeremiah's message of "Sat, 17 Nov 2018 14:27:29 +0000") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Jeremiah@pdp10.guru Cc: guix-devel@gnu.org Hi Jeremiah, Jeremiah@pdp10.guru writes: >> I think it's important that the new bootstrap-tarballs be >> bit-reproducible, such that they can be independently verified by anyone >> who wishes to do so. > > Every Piece below M2-Planet has always been bit-reproducible. > In fact, each piece is designed in a way that you could by hand predict > what the resulting binary must be after any change. Sure, and I'm glad to hear this. However, my impression (correct me if I'm wrong) is that we are not yet able to bootstrap Guix exclusively from M2-Planet. For example, unless I'm mistaken, we still need Guile in our bootstrap, and I'm guessing that we are not yet able to build Guile exclusively from M2-Planet. Is that right? >> My hope until now is that when we generated our existing bootstrap >> binaries in 2013, Guix was too marginal a project to attract the >> attention of hackers who might wish to compromise our bootstrap. In >> 2018, as Guix has become more popular, we might well be considered a >> worthy target of such efforts. > > I like to go with the assumption that every binary is already > compromised; I agree. I didn't mean to imply that I consider our 2013 bootstrap binaries trustworthy. I very much look forward to the day when I needn't blindly trust any precompiled binaries at all. My only point is that if we cannot yet avoid blindly trusting precompiled binaries, I have higher confidence in our 2013 binaries than in binaries we would produce today, because (1) we are more likely to be a target today because Guix has become far more popular, (2) I expect that intelligence agencies have far more advanced tools today than they did in 2013, and (3) I expect that governmental policies have become far more favorable to permitting such attacks against projects such as ours. > I don't trust any hardware I can't or didn't make myself. > And the only root of trust we have is the ability to work as a > community, giving every member the ability to independently check our > assumptions and point out our mistakes. We will have false starts and > failures of imagination but we by working together will make us all a > dream that is too hard to achieve alone but easy now that we have each > other helping us all strive to a brighter future. I very much appreciate your work on this, which is quite important. Regards, Mark