PhD position in the area of secure software supply chain

PhD position in the area of secure software supply chain

[Julien Lepiller]

Hi Guix and bootstrappable!

If any of you is considering starting a PhD, there is one position at
KTH (Sweden). The topic is on bootstrapping and DDC (double divers
compilation), and it's all motivated by the Trusting Trust talk by Ken
Thompson, which is very famous in our community I think :)

Please see the following link for details and application:

https://softwarediversity.eu/hardening-the-software-supply-chain-with-multi-compilers/

Note that you won't work with me, I'm only relaying what I think is a
great opportunity if you're in that stage in your studies. It's really
awesome to see something like that, so close to some of our favorite
topics :)

Re: PhD position in the area of secure software supply chain

[zimoun]

Hi Julien

On Thu, 03 Dec 2020 at 21:47, Julien Lepiller <julien@lepiller.eu> wrote:

> https://softwarediversity.eu/hardening-the-software-supply-chain-with-multi-compilers/

Cool! :-)

Aside, reading a bit some links from there, I am asking myself if Guix
should not be the right platform to test DDC and diversity.  And if non,
what should be missing?


Cheers,
simon

Re: PhD position in the area of secure software supply chain

[Pierre Neidhardt]

[-- Attachment #1: Type: text/plain, Size: 305 bytes --]

Hi!

On a side-note, if those interested would like to know more about moving
there and how life can be like in Stockholm, I'd be happy to discuss it
since I've spent some time over there and I've studied at KTH :) Feel free to
message me!

Cheers!

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 511 bytes --]

Declaring channel dependencies in the operating-system configuration

[Elais Player]

[-- Attachment #1: Type: text/plain, Size: 1414 bytes --]

Hi Guix!

One thing that I've often found to be annoying was manually adding a
channels.scm file to systems, and I've come up with a solution that I'd like to
share.

For those interested in having their channels.scm be added as part of the system
generation process, just do the following.

Create an object representing a scheme file using the `scheme-file` procedure

(define %guix-channels
  (scheme-file
        "channels.scm"
        #~(cons* (channel
                        (name 'example)
                        (url "https://example.org/channel.git"))
                 %default-channels)))

Then add the file-like object to your system services using the
extra-special-file procedure. It symlinks a file from the store to
/etc/guix/channels.scm and makes the channels declared there available to all of
your systems users.

(operating-system
  ...
  (services
    (cons*
      (extra-special-file "/etc/guix/channels.scm"
                          %guix-channels)
      %base-services)))

I think this is a pretty neat solution for those of us who need to use custom
channels, but I was wondering if this is something that can be improved on and
added to the top level operating-system declaration.

Just like we can declare hosts for the operating system would it be a good idea
to declare (channels #~(cons* (channel ...))) too?

Would it make sense to add it as a configuration in guix-service-type?

[-- Attachment #2: Type: text/html, Size: 2756 bytes --]