Re: A registry for distributed sources and binaries

[Tomáš Čech]

On Sun, Jul 24, 2016 at 10:35:43PM +0200, Ricardo Wurmus wrote:
> What do you think about that?  Does this align with your vision?
>
> What do others think?  Is this something that would benefit the Guix
> project and its audience?

I like the idea a lot.

I'm only concerned with security of such thing. When the number of
other package sources will grow, it should be ensured that some
package definition will not touch core/library without user
consent. If they will take packages from random sources (as they are
careful when downloading applications for windows from various sources
or reading licenses), it may easily become security threat to whole
system.

I'd be glad if we can stop using GUIX_PACKAGE_PATH environment
variable (which is a bit clumsy) and have support for multiple source,
with priorities (for cases of collisions) and maybe in future support
for some digital signatures.

\o/

S_W

signature.asc
Description: Digital signature