Hello! Jelle Licht <[email protected]> skribis:
> The source tarball is one release artifact that nobody can reproduce > easily. As far as I can see it is usually built by running "make dist" on > some merry release team member's machine and contains generated files > not in Git. This seems similar (enough) to the gap that xz backdoor made > use of. > > I'm working on a rough series that builds the release tarball from a > single commit with guix time-machine, so anyone can check it. Imagine > being able to run something like this to reproduce the release tarball: > > guix time-machine -q --commit=commit-after-tag-v1.6.0 -- build -e '((@ (gnu > ci release) guix-dist-tarball))' What about this radical proposal: we stop publishing source tarballs. Alternative proposal: we publish a tarball produced by ‘git archive’. This would be in line with our stance on bootstrapping and with <https://codeberg.org/guix/guix/milestone/66679>. In practice, the only people impacted by this would be distros providing Guix, such as Debian. I doubt it would make a difference though: Debian discards non-source artifacts, such as files produced by the autotools, so that’s fine. Of course we must keep providing signed tags and possibly update documentation accordingly. As a side effect, this proposal will simplify the release process, which is always welcome. :-) Thoughts? Ludo’.
