Skip to content

Compare distributions

Compare StageX with other distributions across reproducibility, bootstrapping, OCI packaging, and multi-party verification.

The table below is a high-level comparison of supply chain properties StageX prioritizes:

Property StageX Guix Arch Debian Alpine NixOS Buildroot Chimera Wolfi Yocto
Signers1 2 1 1 1 1 0 0 0 0 0
OCI2 Native Exported Published Published Published Exported Exported Published Native Exported
Language3 Containerfile Scheme Shell Custom Shell Custom Makefile Python YAML Custom
Bootstrapped4 Yes Yes No No No Partial No No Partial No
Reproducible5 Yes Mostly Mostly Mostly No Mostly No No No No
Toolchain6 LLVM GNU GNU GNU GNU GNU GNU LLVM GNU GNU
C Library7 musl glibc glibc glibc musl glibc glibc musl glibc glibc
Allocator8 mimalloc glibc glibc glibc mallocng glibc glibc mimalloc glibc glibc

Use this table as a high-level orientation aid, not a full security audit of each distribution.

See also

For related background and technical details, see:

  1. The minimum number of human signers required to make changes to the distribution.

    Machine-controlled keys, or keys controlled by multiple people, do not count as human signers. ↩

  2. Open Container Initiative support.

    • Native: OCI layers are the native package management system.
    • Exported: the system can export OCI images from a non-OCI build system.
    • Published: the project publishes official OCI images.

    ↩

  3. Domain-specific language used for package build definitions. ↩

  4. Whether the entire distribution can be full-source bootstrapped from Stage0. ↩

  5. Whether the entire distribution is reproduced bit-for-bit identically for every release. ↩

  6. The compiler toolchain family used as the distribution's toolchain base. ↩

  7. The C standard library used by the distribution. ↩

  8. The default memory allocator used by the distribution. ↩