That is kinda what google does as well. It calculates checksums of certain system components and compares it to a checksum in database.
What you are describing is usually called antivirus. But they call their system “integrity”. That word is used for other things in this context.
I do not understand where does your optimism come from? In what little that we do know they describe the exact same system using the exact same wording as google. If they mean some other thing then they should spend a couple of hours and describe how is it different. And before that the worst should be assumed. It is to dangerous to treat it in any other way.
I do not care if it is connected to proprietary ecosystem or not. The freedom to decide what software am I allowed to run on my PC is important for me though. Any system that limits that freedom is evil by definition.
Voluntary for developer? Sure. Voluntary for the user who can’t run software because it requires this shit? Not so sure.
The language used speaks for itself. We already know what “integrity” means in this context.
the company wants Linux systems to be built so their correctness can be explicitly defined and continuously verified.
This does not seem vague to me. It explicitly states what they are creating.
Well, we have a systemd creator and Microsoft employees here…
They want to create a mechanism for software to determine on which system it allows a user to run itself. Google “play integrity” on android and google’s proposal for web integrity API.
So, basically, they want to do to Linux what google is doing to android and tried to do to web. No, thanks.
Which can be hosted on GitHub as well.
But saying that
xbps-srcis like the AUR is very misleading because it lacks the “U” part.
It is misleading because AUR is a repository, but xbps-src is not. It is a tool like makepkg in arch. One could argue that xbps-src is a more advanced tool as it also acts as a package manager itself. A repository that is most commonly used with xbps-src is void-packages which is maintained by void teamm one could build a repo for xbps-src like aur, but to my knowledge it has not been done and is unlikely to succeed any time soon due to a smaller user based compared to arch.
The problem is that this value can be compared to a list of “allowed” values. Therefore it opens the gate to creating software that would require only certain “whitelisted” systems to run it. Such list can be easily updated automatically once those “whitelisted” systems update. Therefore an argument “updates would break it” do not actually work.
This is precisely how play integrity works on android. And Poettering intensions do not matter much. His system can be used like that and therefore it will be used like that.