[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: K of N trust in substitutes (related to reproducible builds)

From: Christopher Baines
Subject: Re: K of N trust in substitutes (related to reproducible builds)
Date: Tue, 16 Jun 2020 20:05:58 +0100
User-agent: mu4e 1.2.0; emacs 26.3

Ludovic Courtès <> writes:

>> 3:
>> Using the above ACL, you'd trust a substitute for a path with a specific
>> hash if you can find 2 narinfos for that path and hash if they're signed
>> with keys in that entry. Multiple entries would still be supported, and
>> you wouldn't need to specify the k-of-n bit if you don't want to.
>> I'm not quite sure how expressive this is, or if there are some policies
>> that would be good to support that either can't be expressed, or can't
>> be expressed easily. There's probably other approaches, and how to
>> support trusting substitutes is an important part to consider.
> I would be tempted to not bake it into /etc/guix/acl.  You would still
> authorize all the servers, but instead of choosing a policy that accepts
> anything signed by one of them, as is currently the case, you would
> choose a policy that only accepts something signed by two of them.
> The policy would be implemented in (guix scripts substitute).  I haven’t
> put much thought into it but it could be something akin to
> ‘lookup-narinfos/diverse’, roughly.
> Thoughts?

I think that could work, do you have any suggestions on how that "two"
would be configured? I guess it could be a boolean on/off, but it would
be probably more extensible to just allow providing a minimum number of
substitiute servers to agree.



Attachment: signature.asc
Description: PGP signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]