[email protected] schreef op za 11-06-2022 om 16:06 [+0000]: > What's good and/or bad about this idea?
A positive point: extra resources, could be useful for reproducibility testing, ...? A negative point: extra points through with malware can be introduced (->compromises). Can be solved by reproducible builds and variation of "guix challenge". Unfortunately, "guix challenge" is inherently racy. "guix substitute" currently only checks that the narinfo has a _single_ authorised signature, maybe it can be adjusted to allow the user to ask: ‘only consider a substitute to be authorised if the same hash is signed by N different authorised keys’? Other points: ...? Greetings, Maxime.
signature.asc
Description: This is a digitally signed message part
