Unless I misunderstood your original question, you don’t trust the Docker signing process, so getting a cryptographically signed image from there seems to fail your criteria.

You could build a Debian base image in-house from scratch if you wanted to and limit your tools to Debian only signed packages.

Ultimately you need to trust something.

For example, how do you trust the microcode updates to your CPU?

I tend to build my own containers for anything that matters, but that might not be a viable option.

Microsoft continues to be the best advocate for migrating to Linux.

If you think YouTube is paying for it, you’re not running a channel of your own at something like 0.001 per view.

Why can’t we have this kind of information as a document that we can read, rather than a video which requires a whole lot more infrastructure?

I read all of it multiple times, before and after editing, and it’s clear to me that we’re failing to communicate.

Markdown and HTML are both examples of markup languages but that doesn’t mean that the words are interchangeable.

It is not possible under any circumstance to represent all that HTML supports within markdown.

Given that HTML supports significantly more formatting than markdown, it’s completely unsurprising that any conversion is imperfect, this is not a flaw in pandoc, it’s simply not possible.

I’ll also point out that I was suggesting that OP starts with markdown and converts that to a required output format using pandoc. The barrier to entry is significantly less than using LaTeX for example.

What are you talking about?

Write it in markdown, segment into separate files for different sections, use pandoc to generate the output.

That’s interesting. It does make me wonder … how does the Go community deal with malicious actors who “tweak” their “vendored” copy of a library, or am I missing something?

No worries, it’s 3am here right now 😁

I meant the users of your project.

This does appear to then break the chain of trust for the users of the project, since it then requires downstream to review even more code.

For example, if you’re an OSS user of three projects that each depend on library X, you now need to trust three copies of this library and make sure that they’re the same as the original.

This seems to be a solution that makes the problem bigger for everyone, not smaller.

So … using a dependency as a submodule?

I don’t understand the author’s description of forking vs. vendoring, the latter being a term I’ve never heard of.

Anyone got any links to something more descriptive?

On SOME ARM64 … but at least it’s a start.

What if it was supported on all hardware that Debian was supported on, that would be something worth getting excited about.

“That’s not a flaw … that’s a feature!”

Around the turn of the century I built a “middleware” layer for an Oracle to MySQL bridge which enabled legacy systems to keep running while modern and open source tooling could be built.

The biggest challenge was moving from columnar to row based data … that and compiling Solaris tools using Oracle libraries.

Oracle is like sendmail, user friendly, just very picky whom it makes friends with.

I’m getting flashbacks to debugging an Oracle connection file.

That was eye opening.