[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Distributed verification of release tarballs using Guix? (was Re: Re
From: |
Ludovic Courtès |
Subject: |
Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?) |
Date: |
Sun, 16 Jun 2019 23:23:05 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/26.2 (gnu/linux) |
Hi Mark,
Mark H Weaver <address@hidden> skribis:
> Ludovic Courtès <address@hidden> writes:
>> What would you think of releasing ‘stable-2.2’ as 2.2.5?
>
> I think it's a fine idea.
Awesome. We’ll have to update NEWS; I can give it a go, but if you
could add bullet items for the things you’ve worked on, that’d be great.
>> It’s great if you can do it, Mark, but otherwise I can do it.
>
> Regrettably, Guile 2.2 has become too heavy to build on the only machine
> in my possession that I have any trust in. I don't have a machine that
> I consider sufficiently trustworthy to produce build outputs for wider
> distribution. I'm not sure that any of us do.
Note that “make dist” is rather inexpensive; “distcheck” is much more
expensive though, but maybe avoidable for a minor release tarball.
> To mitigate the risk that a compromised development machine could be
> used to attack others, I propose that we adopt a practice of distributed
> verification of release tarballs. We would publish code that uses Guix
> to produce the release tarball deterministically, and put out a call for
> volunteers to generate the tarball and post signed declarations
> containing the hash of the resulting tarball. After we have received
> several such declarations, we can sign and publish the official tarball.
I don’t think this should block 2.2.5, but I think it’s an idea we
should explore.
One issue is that “make dist” is non-deterministic because the archive
contains timestamps; I’m sure there of other sources of non-determinism
though, because “make dist” was not designed with that in mind.
The non-source byproducts in release tarballs are: the pre-built .go
files (which are optional), psyntax-pp.scm, and then Info files and all
the autotools machinery. Are these those you had in mind?
Thoughts?
Ludo’.
- Releasing 2.2.5?, Ludovic Courtès, 2019/06/06
- Re: Releasing 2.2.5?, Nala Ginrut, 2019/06/06
- Re: Releasing 2.2.5?, Mike Gran, 2019/06/06
- Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?), Mark H Weaver, 2019/06/16
- Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?),
Ludovic Courtès <=
- Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?), Mark H Weaver, 2019/06/16
- Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?), Ludovic Courtès, 2019/06/17
- Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?), Mark H Weaver, 2019/06/18
- Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?), Ludovic Courtès, 2019/06/20
- Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?), Mark H Weaver, 2019/06/20
- Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?), Neil Jerram, 2019/06/21