Notices by Simon Josefsson (jas@fosstodon.org)

@janneke Yes but achieving anything similar from within Debian seems hard to imagine, or? To me it seems simpler to explore building a smaller set of Debian packages directly from Guix binaries, which are then used to build the rest of the Debian archive, in the hopes that this incremental build process will ultimately be identical to a idempotent rebuild of Debian using itself.

On Binary Distribution Rebuilds https://blog.josefsson.org/2025/03/31/on-binary-distribution-rebuilds/

@vagrantc @josch Great work! I am still waiting for my Rk3588 order, but will try your Linux-libre-based kernel when I receive it. Can it boot to Guix? Did you notice any non-free stuff in those patches?

GNU InetUtils 2.6 release, with "git archive" tarball, GnuPG and Sigsum signatures, and reproducible tarballs including software build of material list nailed down to the particular Guix commit with tools used to generate the tarballs in GitLab pipeline. Happy supply-chain security Friday! https://lists.gnu.org/archive/html/bug-inetutils/2025-02/msg00002.html

@civodul @Mehrad The `podman load` barely takes any time at all, but indeed I want to use skopeo or podman from a native Guix config. I'm getting errors though, ideas? Maybe just a mkdir... https://gitlab.com/debdistutils/guix/container/-/jobs/8714694003

@Mehrad @civodul Latest successful container build is done here: https://gitlab.com/debdistutils/guix/container/-/jobs/8679061592

@Mehrad @civodul Building a Debian+Guix image takes around 25 minutes on a large GitLab runner node. Building the pure Guix image takes around 6 minutes, also on a large GitLab runner node. The Debian+Guix image is used to prepare the native Guix-only image. I have not yet tried to build another Guix-only image from the Guix-only image I have prepared, that is issue #1 and I think it is trivial. https://gitlab.com/debdistutils/guix/container/-/issues/1

OpenSSH and Git on a Post-Quantum SPHINCS+ #pq #ssh #sphincs+ https://blog.josefsson.org/2024/12/23/openssh-and-git-on-a-post-quantum-sphincs/

Wrapping up this work in a blog post: https://blog.josefsson.org/2024/12/18/guix-container-images-for-gitlab-ci-cd/

Please try my GNU Guix container images, for GitLab pipelines and more! #guix https://gitlab.com/debdistutils/guix/container

Friday reading material: "TAF, a framework that aims to provide archival authentication and ensure that Git repositories can be securely cloned and updated" https://github.com/openlawlibrary/taf/blob/master/specification/taf-spec.md#1-introduction

@bagder Where is that GNU number coming from? GNU’s hosting server Savannah has almost 4000 projects: http://savannah.gnu.org/search/index.php

We have Sigstore `cosign` tool in Debian's NEW queue! Please help test #sigstore #cosign https://lists.debian.org/debian-go/2024/12/msg00005.html

@conservancy Interesting project! Why did you choose to support hardware with proprietary firmware in it? Ethically this doesn’t seem all that different from encouraging buying an Apple Mac which also contains a mix of free and proprietary software in it.

There will be a Security Devroom at FOSDEM'25 and we are looking for volunteers to manage it. https://github.com/security-devroom/fosdem-2025

Friendly reminder about the FOSDEM Security Devroom - please submit your talk idea before the weekend is over! Time to write those abstracts

Please welcome Guile-GnuTLS version 4.0.1 https://lists.gnutls.org/pipermail/gnutls-help/2024-November/004870.html

@civodul @shtwzrd @daviwil One could ask if this is a technical (maintainability, stability, risk of unimportant commit breaking entire guix, etc) or social (different maintainer teams, different release schedules, expectations on quality/stability etc) challenge, but one deeper question is: how much is possible to isolate as a minimal computing base, and is that useful? It seems modern packages are more or less circularly dependent anyway.

@drewdevault Nice! However LGPL is not generelly considered a copyleft license. Did you approach Debian/fedora/Guix/etc package maintainers?