Conversation

Notices

1. Embed this notice
   Ludovic Courtès (civodul@toot.aquilenet.fr)'s status on Friday, 13-Dec-2024 18:00:20 JST Ludovic Courtès

   Fully-bootstrapped Mono comes to #Guix:
   https://issues.guix.gnu.org/74609

   Impressive achievement and a nice writeup!

   #Bootstrapping #ReproducibleBuilds

   • MortSinyx likes this.
   • Janneke repeated this.
   • Embed this notice
     Janneke (janneke@todon.nl)'s status on Friday, 13-Dec-2024 21:37:26 JST Janneke

     in reply to

     • Reproducible Builds
     • simendsjo

     @simendsjo @civodul when we "lost" mono because it was discovered (<https://issues.guix.gnu.org/55026>) that #mono upstream simply includes binary blobs in their "source" tarball (an evil that was so alien and unimaginable to me that I failed to check for that when adding the "mono" package) I believed we would most probably never get it back.

     Very sad to see it's not because upstream finally took their responsibility, but extra grateful and kudos for this effort!

     #reproducibleBuilds
     #bootstrappableBuilds
     @reproducible_builds

   • Embed this notice
     simendsjo (simendsjo@fosstodon.org)'s status on Friday, 13-Dec-2024 21:37:27 JST simendsjo

     in reply to

     @civodul

     > You would be hard-pressed to find a more fertile breeding ground for Ken Thompson / Trusting Trust attacks. �If every agent of the NSA (and whatever other agencies, including those of other countries, had access to the appropriate network traffic) somehow failed to capitalize on 6 years of opportunity to compromise an entire software ecosystem using only a basic MITM of unencrypted traffic, they deserve to be sacked.

   • Embed this notice
     simendsjo (simendsjo@fosstodon.org)'s status on Friday, 13-Dec-2024 21:42:48 JST simendsjo

     in reply to

     • Reproducible Builds
     • Janneke

     @janneke @civodul @reproducible_builds Unfortunately, I have to be a lot more pragmatic in order to use Guix. I have packaged both the dotnet sdk binary distributions as well as various closed source binary software for developing dotnet. It's the only way I can use Guix System in practice.

   • Embed this notice
     Janneke (janneke@todon.nl)'s status on Friday, 13-Dec-2024 21:42:48 JST Janneke

     in reply to

     • Reproducible Builds
     • simendsjo

     @simendsjo @civodul @reproducible_builds that's very sad and I hope for you that one day you'll be able to live in the GNU Guix Free Software country, like I am so grateful do.

   • Embed this notice
     Ludovic Courtès (civodul@toot.aquilenet.fr)'s status on Friday, 13-Dec-2024 22:27:42 JST Ludovic Courtès

     in reply to

     • Reproducible Builds
     • Janneke
     • simendsjo

     @simendsjo That’s fine, there are personal choices to make everyday and a number of criteria to take into account.

     In the end, as users of Guix and other distros, we all benefit from the work done around bootstrapping, reproducible builds, or simply writing useful free software. I’m happy to support all those who make significant strides in these areas, and this one is no small feat!

     @reproducible_builds @janneke

   • Embed this notice
     Anthk (anthk@paquita.masto.host)'s status on Sunday, 15-Dec-2024 00:26:58 JST Anthk

     in reply to

     @civodul
     This is like OpenJDK with Jikes/JamVM and the GNU Classpath,
     but with DotGNU.

     I wish GNU classpath had a ./bootstrap script where it could
     download all the required dependencies in the spot.