Building a secure software supply chain with GNU Guix
programming-journal.org
programming-journal.org
Can't help but think that the real tricky part comes after provenance is recorded.
What do you do with all of that - is there something enforcing an allowlist/denylist using the data?
How is being kept updated with new builds and the CI/CD pipeline? All the builds or just with a certain other metadata? How do you handle exceptions? How do you handle devs experimenting?
How are the attestation signing keys being protected?
My pain points were essentially:
- The documentation was great from a reference standpoint, but unfortunately it was rough from an introductory point-of-view. I had great difficulty successfully setting up my own packages.
- Some tooling (such as asdf-vm[0]) didn't work, and it wasn't clear as to why. Note that this was something that I expected and was ready to work around as needed
- While I understand and agree with most of the GNU mantra of free software, it was simply difficult and unwieldy to use my laptop since it required non-free software (including but not limited to WiFi drivers). There is a "nonguix" package repo which can fill this need, but many of their support channels/forums prohibit discussion of non-free software.
Going forward, I really like the idea of Guix. I think if I were to try it again, I'd use it as a package manager on an Arch System, and get comfortable with the more advanced administration tasks before I installed the standalone OS again.
[0] - https://asdf-vm.com/
Tools like Guix or Nix are oriented around describing packages as expressions. This ends up with the result where the Nix packages don't use system libraries. -- Tools that fetch binaries themselves don't always work well, because assumptions that may be true on many Linux distributions might not hold when using NixOS, or even just nix on other distributions.
Though, using asdf from Nix/Guix sounds a bit like trying to use a scythe while riding on a lawn mower.
I don't disagree - I turned back to asdf (which I use on most cases) after fumbling too much with defining Guix packages, under the thought of "what a pain in the ass, I'll try what I usually use"
I do think I'll take another crack at Guix at some point, but with more realistic expectations of not being able to know everything about it in a weekend :)
One easy solution is to use Guix's Nix service[1], which lets you install packages from the Nix package manager.
[1] https://guix.gnu.org/manual/en/html_node/Miscellaneous-Servi...