4
Trying Guix: A Nixer's Impressions (tazj.in)
submitted 1 year ago by to c/guix@infosec.pub
comment fedilink hide all child comments

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
5 comments in c/linux@programming.dev view that post
[–] 2 points 1 year ago* (4 children)

And in a way where malicious programs can't be removed from the repos, like in AUR? Where people who repeatedly publish supply chain attacks can't be banned?

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 1 point 1 year ago (3 children)

    Wat?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 year ago (2 children)

    AUR has centralized control. You have to have an account to post packages. When malicious software is found in AUR (as it was recently), the packages can be removed and the user who submitted them, banned (in the recent case, two packages were submitted by the same contributor).

    The OP article compares the GUIX distribution mechanism to AUR. What they described is decentralized and distributed. It's less like AUR than it is like having people run wget https://url.com/install.sh | bash.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 1 year ago* (1 child)

    Guix channels are just git repos with lists of package definitions. You need to manually add non-official repos, and all git contribution controls apply.

    Edit: non-official repos are closer to Ubuntu PPA-s. Don't really see how they relate to AUR apart from being user generated.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •