Doesn't caching completely defeat the point of bootstrapping? How do you know the cached artifact is correct? You have to build it manually to verify that, at which point you're still building manually...
"guix build --no-grafts --no-substitutes --check foo" will force a local rebuild of package foo and fail if the result is not bit-identical. "guix challenge" will compare your local binaries against multiple cache servers.
I build everything locally and compare my results with the official substitute servers from time to time.
It obviously depends on the hardware, but IIRC for me maybe 3-4 hours building from the 357 byte seed to the latest GCC.
The early binaries are not very optimized :-)
With caching, just the time to download the artefact.
Doesn't caching completely defeat the point of bootstrapping? How do you know the cached artifact is correct? You have to build it manually to verify that, at which point you're still building manually...
Guix has tooling to verify binaries:
https://guix.gnu.org/en/manual/en/html_node/Invoking-guix-ch...
"guix build --no-grafts --no-substitutes --check foo" will force a local rebuild of package foo and fail if the result is not bit-identical. "guix challenge" will compare your local binaries against multiple cache servers.
I build everything locally and compare my results with the official substitute servers from time to time.
1. hash it
2. rebuild it without the cache
3. hash that
4. compare
Or, trust somebody who has. Inconvenient, but is there any other way to establish trust in the correspondence between code and a binary?
You have a hash that n trusted parties agree on. This is enabled by reproducible builds.