Foxboron

> Could be one or one thousand. Frankly, the exact number doesn't matter.

It does. Manually checking a couple of AUR packages is easy. Installing a thousand AUR packages is not something anyone should be doing.

> I'm assuming people are using the AUR to install programs that are sufficiently complex and the idea one can trivially audit a complex program and all of its dependencies is foolish. The foolishness of that expectation scales with the number of complex programs installed.

Nobody is asking them to do that. The premise is that the `PKGBUILD` and auxillary files provided by the AUR should be checked.

> The idea that users should "just check the source code every single time" has never been, nor will it ever be, a reasonable solution to supply chain attacks.

Again, nobody is asking anyone to do this.

> Expecting users to manually review every single change, for every single AUR package they are using, every single time they do an update or installation is just unreasonable if you want to AUR to be useful at all for the general user.

How many AUR packages are you assuming people are installing?

> The host key section makes me wonder about doing this with servers, but what are the security guarantees in places like the cloud with that? Are you relegated to a software TPM, and if so, what guarantees does a software TPM have?

For the cloud? You would probably have a software TPM so not super secure, but you would still prevent the keys from being extracted away from the server. And if you don't trust your hypervisor/cloud provider you probably have other issues?

In my head the security guarantees are more straightforward for physical servers where you have a fTPM or a dTPM.

> My question after reading the README.md: what are the requirements from the OS? Can it be Windows, Linux, etc?

This only supports Linux.

This just reads like a LLM trying to come up with a conspiracy theory around systemd.

It somehow got hyper-fixated on "three" for no particular reason and seems like it decided to harpen down that fact without explaining anything around it?

> Maintainers: You’re a primary maintainer or core team member of a public repo with 5,000+ GitHub stars or 1M+ monthly NPM downloads. You've made commits, releases, or PR reviews within the last 3 months.

Laughable.

This is a tiny, if even unimportant, fraction of the FOSS community that runs the modern tech stack.

I have reported several spam emails to Github and from what I can tell none has been acted upon.

Nor the 20 or so odd reimplementations of various filesystem drivers and LUKS encryption in the grub2 tree.

But, who is counting?

> Sure, but can the system context-switch that PCR between two different users?

Right, no it can't.

But this was not really something the TPM was suppose to solve.

UEFI on x86_64 and phones are not comparable when it comes to being "locked down".

Phones don't implement UEFI.