Simon Josefsson's blog

Today marks the day of soft-launching of my Debian derivative, which I’ve been using on several of my own machines for the past year or so.

I’ve been using rsnapshot to take backups of around 10 servers and laptops for well over 15 years, and it is a remarkably reliable tool that has proven itself many times.

Following up on my initial announcement about Debian Libre Live I am happy to report on continued progress and the release of Debian Libre Live version 13.3.0.

One of my holiday projects was to understand and gain more trust in how Debian binaries are built, and as the holidays are coming to an end, I’d like to introduce a new research project called Debian Taco.

Around a year ago I wrote about Guix Container Images for GitLab CI/CD and these images have served the community well.

Last week I published Guix on Debian container images that prepared for today’s announcement of Guix on Trisquel/Ubuntu container images.

The debian-with-guix-container project build and publish container images of Debian GNU/Linux stable with GNU Guix installed.

The Debian Libre Live Images allows you to run and install Debian GNU/Linux without non-free software.

The gnulib project publish a git bundle as a stable archival copy of the gnulib git repository once in a while.

After thinking about multi-stage Debian rebuilds I wanted to implement the idea.

I host my own GitLab CI/CD runners, and find that having coverage on the riscv64 CPU architecture is useful for testing things.

Remember the XZ Utils backdoor?

I rebuilt (the top-50 popcon) Debian and Ubuntu packages, on amd64 and arm64, and compared the results a couple of months ago.

Around a year ago I discussed two concerns with software release archives (tarball artifacts) that could be improved to increase confidence in the supply-chain security of software releases.

Are you aware that Git commits and tags may be signed using OpenSSH?

I am using GitLab CI/CD pipelines for several upstream projects (libidn, libidn2, gsasl, inetutils, libtasn1, libntlm, …) and a long-time concern for these have been that there is too little testing on GNU Guix.

After rebuilding all added/modified packages in Trisquel, I have been circling around the elephant in the room: 99% of the binary packages in Trisquel comes from Ubuntu, which to a large extent are built from Debian source packages.

With the release of Libntlm version 1.8 the release tarball can be reproduced on several distributions.

While the work to analyze the xz backdoor is in progress, several ideas have been suggested to improve the software supply chain ecosystem.

My effort to improve transparency and confidence of public apt archives continues.

Having had success running Trisquel on the ppc64 Talos II, I felt ready to get an arm64 machine running Trisquel.

Recently I noticed a new tool called licenserecon written by Peter Blackman, and I helped get licenserecon into Debian.

My earlier work on Streamlined NTRU Prime has been progressing along.

The release notes for Trisquel 11.0 “Aramo” mention support for POWER and ARM architectures, however the download area only contains links for x86, and forum posts suggest there is a lack of instructions how to run Trisquel on non-x86.

For Debian package maintainers, the wrap-and-sort tool is one of those nice tools that I use once in a while, and every time have to re-read the documentation to conclude that I want to use the --wrap-always --short-indent --trailing-comma --sort-binary-p…

A personal reflection on how I moved from my Debian home to find two new homes with Trisquel and Guix for my own ethical computing, and while doing so settled my dilemma about further Debian contributions.

The OpenSSH project added support for a hybrid Streamlined NTRU Prime post-quantum key encapsulation method sntrup761 to strengthen their X25519-based default in their version 8.5 released on 2021-03-03.

Let’s reflect on some of my recent work that started with understanding Trisquel GNU/Linux, improving transparency into apt-archives, working on reproducible builds of Trisquel, strengthening verification of apt-archives with Sigstore, and finally thinking

I’d like to describe and discuss a threat model for computational devices.

As suggested in my initial announcement of apt-sigstore my plan was to look into stronger uses of Sigstore than rekor, and I’m now happy to announce that the apt-cosign plugin has been added to apt-sigstore and the operational project debdistcanary is pub…

Building on my work to rebuild Trisquel GNU/Linux 11.0 aramo, it felt simple to generalize the tooling to any two apt-repository pairs and I’ve created debdistreproduce as a template-project for doing this through the infrastructure of GitLab CI/CD and me…

Do you want your apt-get update to only ever use files whose hash checksum have been recorded in the globally immutable tamper-resistance ledger rekor provided by the Sigstore project?

The absolute number may not be impressive, but what I hope is at least a useful contribution is that there actually is a number on how much of Trisquel is reproducible.

I’ve used hardware-backed OpenPGP keys since 2006 when I imported newly generated rsa1024 subkeys to a FSFE Fellowship card.

I’ve always found the operation of apt software package repositories to be a mystery.

Ever wondered how Trisquel and Ubuntu differs and what’s behind the curtain from a developer perspective?

I’m migrating some self-hosted virtual machines to Trisquel, and noticed that Trisquel does not offer cloud-images similar to the Debian Cloud and Ubuntu Cloud images.

I use GnuPG to compute cryptographic signatures for my emails, git commits/tags, and software release artifacts (tarballs).

While my first impression of Guix 1.4rc2 on NV41PZ was only days ago, the final Guix 1.4 release has happened.

On the shortlist of things to try on my new laptop has been Guix.

My NovaCustom NV41PZ laptop arrived a couple of days ago, and today I had some time to install it.

I’m about to migrate to a new laptop, having done a brief pre-purchase review of options on Fosstodon and reaching a decision to buy the NovaCustom NV41.

The Guile bindings for GnuTLS has been part of GnuTLS since spring 2007 when Ludovic Courtès contributed it after some initial discussion.

To protect web resources with Kerberos you may use Apache HTTPD with mod_auth_gssapi — however, all web scripts (e.g., PHP) run under Apache will have access to the Kerberos long-term symmetric secret credential (keytab).

I self-host some services on virtual machines (VMs), and I’m currently using Debian 11.x as the host machine relying on the libvirt infrastructure to manage QEMU/KVM machines.

GSS-API is a standardized framework that is used by applications to, primarily, support Kerberos V5 authentication.

Simple Authentication and Security Layer (SASL, RFC4422) is the framework that was abstracted from the IMAP and POP protocols.

The Debian operating system is what I have been using on my main computer for what is probably around 20 years.

I use Icinga to monitor the availability of my Debian/OpenWRT/etc machines.

Debian buster is almost released, and today I celebrate midsummer by installing (a pre-release) of it on my Lenovo X201 laptop.