@rekahsoft Guix goes further than any other distro and was a big inspiration, but it is not 100% reproducible/bootstrapped, trusts downloaded binaries, has a single-party trust model, chooses the GNU way of doing things above all others.
As a desktop-first distro with thousands of packages it would make it incredibly difficult to ever fully clear those bars.
Our threat model mandated the design a distro and release process built for supply chain security.
@lrvick really interesting work! I'm curious what you thing of #guix and where it falls short (re security)? It sounds like you view it overall quiet favorably (relative to other distros)
A few things I can think of:
- uses linux-libre (so no microcode updates); this is overcame by using non-guix which does supply them
- depends on a central hydra, enabled by default; this too is overcomable by running an internal cuirass (guix's build server)
Best wishes!
@rekahsoft Guix goes further than any other distro and was a big inspiration, but it is not 100% reproducible/bootstrapped, trusts downloaded binaries, has a single-party trust model, chooses the GNU way of doing things above all others.
As a desktop-first distro with thousands of packages it would make it incredibly difficult to ever fully clear those bars.
Our threat model mandated the design a distro and release process built for supply chain security.
@lrvick Hi! I’m not sure what the “GNU way of doing things” is but Guix has a long track record regarding #bootstrapping and #ReproducibleBuilds and is used in production:
https://guix.gnu.org/en/blog/tags/bootstrapping/
(The “like no distro before it” punchline on the stagex home page is… questionable.)
That said, it’s good news that more distros are joining Guix and live-bootstrap on this journey!
The “like no distro before it” punchline on the stagex home page is… questionableIf a punch line was the only questionable issue with #guix, I'd have given it a try years ago.
@giacomo @civodul @lrvick @rekahsoft Apologize for what? Having and voicing an opinion?
