74

How can users confidently verify that a FOSS application is running from its published source code? Is there a easy way to check this, or is this based of checksum and hashes?

you are viewing a single comment's thread
view the rest of the comments
[-] aurtzy@discuss.tchncs.de 10 points 1 year ago

You might find The Full-Source Bootstrap: Building from source all the way down by some of the GNU Guix maintainers of interest to read, which discusses how Guix is attempting to solve the "trusting trust" attack some have mentioned here.

Although I haven't used it myself yet, Guix actually has a feature that lets you "challenge" the build servers to see if your builds match the pre-built binaries (the command being aptly named guix challenge).

[-] theshatterstone54@feddit.uk 1 points 1 year ago

Do you use Guix? I've found it quite interesting and I'd love to try it out one day. The thing is, I need the mainline Linux kernel for some proprietary drivers.

[-] aurtzy@discuss.tchncs.de 4 points 1 year ago

I do!

For starters, you're not required to install Guix System in order to use the Guix package manager itself; the manual provides instructions for installing it on top of your existing system here if you want to use it but not fully commit (you can do this with Nix too).

Guix allows for adding new sources to pull packages from using channels. The nonguix channel provides the Linux kernel - blobs and all - as well as other stuff that won't be upstreamed, like Steam and NVIDIA drivers.

I recommend this helpful series by System Crafters, which includes a few guides on installing Guix and Guix System with the full Linux kernel.

[-] theshatterstone54@feddit.uk 1 points 1 year ago

Thank you. I currently use NixOS, but Guix always seemed interesting.

[-] aurtzy@discuss.tchncs.de 1 points 1 year ago

It's my pleasure :)

Just a note if you plan on installing Guix on top though, since I didn't realize you might be running NixOS: according to this discussion, you'd need to take a different route to get Guix working.

load more comments (1 replies)
load more comments (1 replies)
this post was submitted on 01 Sep 2023
74 points (98.7% liked)

Open Source

31133 readers
314 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS