Re: Guix git master reset

[Tobias Geerinckx-Rice]

Tobias Geerinckx-Rice 写道：
> There was nothing wrong with the reverted commit; it was simply 
> signed
> with a different key than ‘guix pull’ expects.

To generalise: ‘guix pull’ already tries not to trust mirrors by 
independently verifying GPG commits, assuming you've pulled from 
an uncompromised repository once before.

Mirrors that cautiously refuse to update to a reset head offer no 
security advantage, but they will silently serve old (and possibly 
vulnerable) packages to users.

Kind regards,

T G-R

signature.asc
Description: PGP signature