guix.cbaines.net - Substitutes for GNU Guix

This is an experiment by Christopher Baines in building Guix packages and providing substitutes. Please send questions, comments or feedback to mail@cbaines.net.

Availability for x86_64-linux and i686-linux should be good, and aarch64-linux is a work in progress. Cross built packages from x86_64-linux to aarch64-linux-gnu, arm-linux-gnueabihf and i586-pc-gnu are also available.

Keep in mind that there is trust involved in substitutes you use, you're trusting the provider to provide substitutes that correspond to the relevant source material.

Additionally, this service could disappear at any time, I'd like to maintain it long term, but that's not a commitment I'm making at the moment. If you're still interested in using these substitutes, the configuration you'll need is below.

Using these substiutes

The URL to use to fetch substitutes is https://guix.cbaines.net, and they're signed with the following key.

(public-key
 (ecc
  (curve Ed25519)
  (q #5F5F4F321533D3A38F909785E682798933BA9BE257C97E5ABC07DD08F27B8DBF#)
 )
)

Setup for generating the substitutes

The Guix Build Coordinator is being used to manage building the packages, and generating the narinfo files. It's at the prototype stage of development, and this is one way of testing it.

Currently, guix.cbaines.net points as a small virtual server hosted by Vultr in their Singapore location. It serves substitutes through NGinx, which reverse proxies the requests to the storage on Wasabi.com.

Additionally, there are multiple machines being used to perform builds. Two bare-metal machines from Hetzner, some virtual servers hosted by Vultr, Linode, and Hetzner plus two self-hosted Raspberry Pi 4's.

I think there is value in tighter controls over the signing key, and hardware, as that should reduce the opportunities for tampering. However, I'm also hoping that in the future, you'll be able to trust substitutes only if several independent parties generating them agree on what's been generated, which could reduce the risk involved in using substitutes.

If you're interested in supporting this effort, you can support through Liberapay .