News for hackers. Stuff that matters.
Re:A BSD person tries Alpine Linux by DEADMINCE on Saturday April 27, 2024 @04:50AM (#40178446)
> Alpine is not full-source-bootstrapped, often imports and trusts external binaries blindly, has no signed commits, no signed reviews, no signed packages, and is not reproducible.

Are Void or Chimera any better?

Re:A BSD person tries Alpine Linux by q66 on Saturday April 27, 2024 @08:37AM (#40179480)
the above is not entirely correct, alpine does have and always had signed packages

in the other aspects most distros are generally not much or at all better, since all that stuff is hard and takes extra infrastructure

in chimera we try to make source bootstrap possible and in general not rely on third party executables, but it's not always possible (e.g. some language toolchains were bootstrapped from official binaries originally) and we try to respect best practices for reproducibility (pretty sure alpine does too) but actually verifying it would need dedicated infra/resources, so we don't do it