Re: [GNU-linux-libre] Help users to verify their downloads

[Donald Robertson]

On 06/20/2018 10:18 AM, Ludovic Courtès wrote:
> Hello Donald & all,
> 
> GNU Guix uses signed tags and commits on its Git repository, which is
> where package definitions are, and release files on alpha.gnu.org are
> also GPG-signed by one of the maintainers.
> 
> Pre-built binaries for packages, which are opt-in, are also signed.
> It’s up to the user to decide whether or not to trust binaries provided
> by, say, hydra.gnu.org:
> 
>   
> https://www.gnu.org/software/guix/manual/html_node/Substitute-Server-Authorization.html
> 
> Most of our package builds are bit-reproducible so users can “challenge”
> servers that provide binaries—i.e., check whether they provide the same
> binaries as other servers or the same as those they built locally:
> 
>   
> https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-challenge.html
> 
> Ludo’.
> 

Thanks for this info. Looking over the discussion thus far I'm thinking
that what we really ought to do is put together some documentation on
some best practices for free distros. Things that aren't really freedom
issues, but are important for making sure everyone can get the best out
of the program. I don't want to end up where we sort things out now for
currently endorsed distros and then forget to ever bring the issue back
up in the future. So I think it makes sense to put something up in a
public place that distros can refer to going forward.

In addition to the topic we've been discussing I've had some other
issues brought up, such as making sure that distro maintainers keep in
contact, and what to do when a maintainer is handing the project off to
a new maintainer. A lot of this stuff is addressed for GNU Maintainers
in the Information for Maintainers of GNU Software
<https://www.gnu.org/prep/maintain/html_node/index.html>, but I think we
could make a much smaller document on the LibrePlanet wiki that could be
similarly useful for distro maintainers.

Does that all make sense?

-- 
Donald R. Robertson, III, J.D.
Licensing & Compliance Manager
Free Software Foundation
51 Franklin Street, Fifth Floor
Boston, MA 02110
Phone +1-617-542-5942
Fax +1-617-542-2652 ex. 56

signature.asc
Description: OpenPGP digital signature