---

5.3.7 Sobre la confianza en binarios

Today, each individual’s control over their own computing is at the mercy of institutions, corporations, and groups with enough power and determination to subvert the computing infrastructure and exploit its weaknesses. While using substitutes can be convenient, we encourage users to also build on their own, or even run their own build farm, such that the project run substitute servers are less of an interesting target. One way to help is by publishing the software you build using guix publish so that others have one more choice of server to download substitutes from (see Invocación de guix publish).

Guix has the foundations to maximize build reproducibility (see Características). In most cases, independent builds of a given package or derivation should yield bit-identical results. Thus, through a diverse set of independent package builds, we can strengthen the integrity of our systems. The guix challenge command aims to help users assess substitute servers, and to assist developers in finding out about non-deterministic package builds (see Invocación de guix challenge). Similarly, the --check option of guix build allows users to check whether previously-installed substitutes are genuine by rebuilding them locally (see guix build --check). To force a full rebuild of a package (ignoring security updates via grafts (see Actualizaciones de seguridad), if any grafts exist—which is not always the case), use --check together with --no-grafts (see --no-grafts). Because grafts are built as their own derivation, if the package you want to rebuild is subject to being grafted, merely using --check will only rebuild the grafting derivation, and not actually recompile the package.

En el futuro, queremos que Guix permita la publicación y obtención de binarios hacia/desde otras usuarias, entre pares (P2P). En caso de interesarle hablar sobre este proyecto, unase a nosotras en guix-devel@gnu.org.