Subject: Re: bug#65866: [PATCH 0/8] Add built-in builder for Git checkouts

From: Ludovic Courtès <[email-masked]>
Date: Sun, 01 Oct 2023 17:02:05 +0200

Hi,

Simon Tournier <[email-masked]> skribis:

> On Tue, 26 Sept 2023 at 17:44, Ludovic Courtès <[email-masked]> wrote:
>
>> I changed the docstring as you suggest and pushed the whole thing:
>
> I am not convinced that we reached a consensus about this series.
> Because enlarging the "Trusting Computing Base" as this series does
> cannot be dismissed as "drifting" and had not been discussed at all
> before pushing although I raised the concern.

The reasoning for “builtin:git-download” is the same as for
“builtin:download”, which was introduced in 2016¹, and which is itself a
logical followup to the notion of fixed-output derivations.

None of these increases the TCB because they’re about downloading data
whose contents are known in advance.

I think it’s important in these discussions to make sure we start from a
shared understanding so we can remain focused and productive.

Ludo’.

¹ https://issues.guix.gnu.org/22774