How can users confidently verify that a FOSS application is running from its published source code? Is there a easy way to check this, or is this based of checksum and hashes?

  • aurtzy
    link
    fedilink
    English
    arrow-up
    4
    ·
    1 year ago

    I do!

    For starters, you’re not required to install Guix System in order to use the Guix package manager itself; the manual provides instructions for installing it on top of your existing system here if you want to use it but not fully commit (you can do this with Nix too).

    Guix allows for adding new sources to pull packages from using channels. The nonguix channel provides the Linux kernel - blobs and all - as well as other stuff that won’t be upstreamed, like Steam and NVIDIA drivers.

    I recommend this helpful series by System Crafters, which includes a few guides on installing Guix and Guix System with the full Linux kernel.

      • aurtzy
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        It’s my pleasure :)

        Just a note if you plan on installing Guix on top though, since I didn’t realize you might be running NixOS: according to this discussion, you’d need to take a different route to get Guix working.