Notices by Simon Josefsson (jas@fosstodon.org)

@civodul @Mehrad The `podman load` barely takes any time at all, but indeed I want to use skopeo or podman from a native Guix config. I'm getting errors though, ideas? Maybe just a mkdir... https://gitlab.com/debdistutils/guix/container/-/jobs/8714694003

@Mehrad @civodul Latest successful container build is done here: https://gitlab.com/debdistutils/guix/container/-/jobs/8679061592

@Mehrad @civodul Building a Debian+Guix image takes around 25 minutes on a large GitLab runner node. Building the pure Guix image takes around 6 minutes, also on a large GitLab runner node. The Debian+Guix image is used to prepare the native Guix-only image. I have not yet tried to build another Guix-only image from the Guix-only image I have prepared, that is issue #1 and I think it is trivial. https://gitlab.com/debdistutils/guix/container/-/issues/1

OpenSSH and Git on a Post-Quantum SPHINCS+ #pq #ssh #sphincs+ https://blog.josefsson.org/2024/12/23/openssh-and-git-on-a-post-quantum-sphincs/

Wrapping up this work in a blog post: https://blog.josefsson.org/2024/12/18/guix-container-images-for-gitlab-ci-cd/

Please try my GNU Guix container images, for GitLab pipelines and more! #guix https://gitlab.com/debdistutils/guix/container

Friday reading material: "TAF, a framework that aims to provide archival authentication and ensure that Git repositories can be securely cloned and updated" https://github.com/openlawlibrary/taf/blob/master/specification/taf-spec.md#1-introduction

@bagder Where is that GNU number coming from? GNU’s hosting server Savannah has almost 4000 projects: http://savannah.gnu.org/search/index.php

We have Sigstore `cosign` tool in Debian's NEW queue! Please help test #sigstore #cosign https://lists.debian.org/debian-go/2024/12/msg00005.html

@conservancy Interesting project! Why did you choose to support hardware with proprietary firmware in it? Ethically this doesn’t seem all that different from encouraging buying an Apple Mac which also contains a mix of free and proprietary software in it.

There will be a Security Devroom at FOSDEM'25 and we are looking for volunteers to manage it. https://github.com/security-devroom/fosdem-2025

Friendly reminder about the FOSDEM Security Devroom - please submit your talk idea before the weekend is over! Time to write those abstracts

Please welcome Guile-GnuTLS version 4.0.1 https://lists.gnutls.org/pipermail/gnutls-help/2024-November/004870.html

@civodul @shtwzrd @daviwil One could ask if this is a technical (maintainability, stability, risk of unimportant commit breaking entire guix, etc) or social (different maintainer teams, different release schedules, expectations on quality/stability etc) challenge, but one deeper question is: how much is possible to isolate as a minimal computing base, and is that useful? It seems modern packages are more or less circularly dependent anyway.

@drewdevault Nice! However LGPL is not generelly considered a copyleft license. Did you approach Debian/fedora/Guix/etc package maintainers?