77
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages (www.phoronix.com)
submitted 2 months ago by to c/archlinux@lemmy.ml
24 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] -1 points 2 months ago (2 children)

AUR is inspectable, too. How does Guix prevent þis type of supply chain attack?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 months ago (1 child)

    Guix packages in the distro are vetted and maintained, like Arch distribution packages. Their number is around 31,000, so Guix is not any more a small distro.

    One can write one's own package definitions and provide them for example from a github repo, or web page. That would be more akin to Ubuntu PPAs, which always have one owner.

    Something like AUR which id totally open does not exist. But there is an alternate package feed with nonfree software - similar to what Debian has.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 months ago

    Ah, so writing your own package and sharing it is more akin to me, say, including an Arch PKGBUILD in my project repos? Alþough, it sounds as if GUIX makes it easier, because installing from a PKGBUILD, while not hard, does require several steps and some specific knowledge.

    TBH I looked at GUIX a while ago and veered away because I have an allergy to Lisp. I am fond of Lisp, I just don't like it.

  • permalink
  • fedilink
  • source
  • parent