#22883 - Trustable "guix pull" - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #11 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 2 Mar 2016 21:07:09 +0000
From debbugs-submit-bounces@debbugs.gnu.org Wed Mar 02 16:07:09 2016
Received: from localhost ([127.0.0.1]:58184 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1abDzB-00011u-6B
	for submit@debbugs.gnu.org; Wed, 02 Mar 2016 16:07:09 -0500
Received: from dustycloud.org ([50.116.34.160]:52584)
 by debbugs.gnu.org with esmtp (Exim 4.84)
 (envelope-from <cwebber@dustycloud.org>) id 1abDzA-00011n-11
 for 22883@debbugs.gnu.org; Wed, 02 Mar 2016 16:07:08 -0500
Received: from oolong (localhost [127.0.0.1])
 by dustycloud.org (Postfix) with ESMTPS id 3DBE7266F6;
 Wed,  2 Mar 2016 16:07:05 -0500 (EST)
References: <87io14sqoa.fsf@dustycloud.org> <20160302192642.GA16774@jasmine>
User-agent: mu4e 0.9.13; emacs 24.5.1
From: Christopher Allan Webber <cwebber@dustycloud.org>
To: Leo Famulari <leo@famulari.name>
Subject: Re: bug#22883: Trustable "guix pull"
In-reply-to: <20160302192642.GA16774@jasmine>
Date: Wed, 02 Mar 2016 13:07:04 -0800
Message-ID: <878u20si6f.fsf@dustycloud.org>
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: -0.0 (/)
X-Debbugs-Envelope-To: 22883
Cc: 22883@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -0.0 (/)

Leo Famulari writes:

> On Wed, Mar 02, 2016 at 10:03:59AM -0800, Christopher Allan Webber wrote:
>> Right now, when a user does a "guix pull", that pulls down the latest
>> repository of code from git, which is kept in a tarball.  Once you
>> receive the latest code, this has some checks: what's the hash of each
>> package, etc.
>
> A discussion worth having. But, let's merge this bug into
> debbugs.gnu.org/22629.

I'm not sure they should be merged, though they're related.  That thread
doesn't deal at all with security, though it provides some other good
ideas.  It even says:

  PS: I do not mention the issue of authenticating code here, which is
      obviously very important and deserves to be treated separately.

However I have no objections to merging them if others think we should

> Also, we should read "The Update Framework" as requested there.

This?  https://theupdateframework.github.io/

There seem to be quite a few papers there!

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:18:54 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#22883 Trustable "guix pull"