Re:A BSD person tries Alpine Linux
by fullspectrumdev on Friday April 26, 2024 @06:13PM
(#40174884)
Getting all those things right costs money to pay developers.
Alpine aren’t exactly drowning in money, despite so much container shit being built off their backs.
> Alpine is not full-source-bootstrapped, often imports and trusts external binaries blindly, has no signed commits, no signed reviews, no signed packages, and is not reproducible.
Are Void or Chimera any better?
the above is not entirely correct, alpine does have and always had signed packages
in the other aspects most distros are generally not much or at all better, since all that stuff is hard and takes extra infrastructure
in chimera we try to make source bootstrap possible and in general not rely on third party executables, but it's not always possible (e.g. some language toolchains were bootstrapped from official binaries originally) and we try to respect best practices for reproducibility (pretty sure alpine does too) but actually verifying it would need dedicated infra/resources, so we don't do it
> "Alpine is not full-source-bootstrapped, often imports and trusts external binaries blindly, has no signed commits, no signed reviews, no signed packages, and is not reproducible. It is one phished git account away from a major supply chain attack any day now.
Alpine chooses low security for low contribution friction. It is the Wikipedia of Linux distros, which granted it a huge package repository fantastic for experimental use and reference, but it is not something sane to blindly trust the latest packages of in production."
I'd be grateful to hear other expert opinions.