Project

General

Profile

Issue #2225

Find how to ship source code with guix pack

Added by Denis 'GNUtoo' Carikli 7 months ago. Updated about 2 months ago.

Status:
Closed
Priority:
Normal
Category:
Legal
Target version:
-
Start date:
02/25/2021
Due date:
% Done:

0%

Estimated time:
Resolution:
fixed
Device:
Not device specific
Grant:
Type of work:
Communication (mails, contacting people, etc), Lisp programming and/or work on Guix
#1

Updated by Denis 'GNUtoo' Carikli 7 months ago

We now ship repo to be able to still build Replicant 6: https://ftp.osuosl.org/pub/replicant/build-tools/

Wile Guix tarballs should be reproducible, and that everything is documented to produce the same tarball (we have a manifest inside, the commands used to do it are in the README.txt, and the source code archives are even backed up by Heritage, and Guix knowns how to fetch them), we probably still need to provide the repo source code along with the source code of other dependencies as per the GPLv2 :

If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.

#2

Updated by Denis 'GNUtoo' Carikli 7 months ago

  • Type of work Lisp programming and/or work on Guix added
#3

Updated by Denis 'GNUtoo' Carikli 7 months ago

  • Device Not device specific added
  • Device deleted (Unknown)
#4

Updated by Denis 'GNUtoo' Carikli 7 months ago

  • Type of work Communication (mails, contacting people, etc) added
#5

Updated by Denis 'GNUtoo' Carikli 7 months ago

  • Category changed from Freedom to Legal
#6

Updated by Denis 'GNUtoo' Carikli about 2 months ago

On #guix, I was told that I could use the following command to get all the corresponding source code:

$ guix build --sources=transitive git-repo
/gnu/store/z2xswqmxqxfqr86yfmgk4468np6mlsn8-pytest-5.3.5.tar.gz
/gnu/store/3bpy0k170ls57j7iaka035d2ad2vqhvw-git-repo-2.4.1-checkout
/gnu/store/7ydrhd1l4ml9lr1jds9iwqkafb9krgry-git-2.31.1.tar.xz
/gnu/store/zc51ka7ywcgsnafx2mnpa25m1yxnf7pq-git-manpages-2.31.1.tar.xz
/gnu/store/6fpff85100i1inlmmbgn5n62v8372wl8-openssh-8.6p1.tar.xz
/gnu/store/hf8ks3jmhgxy5nab2ml4lbascgxmjriq-tar-1.32.tar.xz
/gnu/store/5dh059d365953arhixlx4xqkngwv2jmr-gzip-1.10.tar.xz
/gnu/store/q5sqgng4wdzxr6yrvvp706kbxa3fcfjf-bzip2-1.0.8.tar.gz
/gnu/store/qa3sp0f1qpqhrzb0v9y5kfgyr61dh70r-xz-5.2.4.tar.gz
/gnu/store/vn2va1z43xkd1qxb1ydbc4934gl6kzz9-file-5.38.tar.gz
/gnu/store/l4qq4a2vzh0jv7bvmm18vwx04qawnx44-diffutils-3.7.tar.xz
/gnu/store/9dd0y2li21gnvgqj6ic9cpdci34gllyy-patch-2.7.6.tar.xz
/gnu/store/6xll0wcqhxj121xbc74svhdf94wq4smz-findutils-4.7.0.tar.xz
/gnu/store/l9vhv074g8m4zqc420d6d21qm21a6ggw-gawk-5.0.1.tar.xz
/gnu/store/9389fg6fgqdl1kgyyd2pz2qw6194cs7v-sed-4.8.tar.gz
/gnu/store/53xsnszbz9vxcz5yh6as0jcx5r39llg0-grep-3.4.tar.xz
/gnu/store/ba4d1lp4mbcb99klnyxnzjv0yncjp29x-coreutils-8.32.tar.xz
/gnu/store/92aasjpjaaxmnxvzpgzzr4bs1n9l7w5f-make-4.3.tar.xz
/gnu/store/sdvchr0j39imynn7barz16z51gfiggn5-bash-5.0.tar.xz
/gnu/store/89a7hma91jf6bx052y05jhi9px7icjkx-binutils-2.34.tar.xz
/gnu/store/bqbblvdhswy94l0d5mir7l7c2a49qv7h-gcc-7.5.0.tar.xz
/gnu/store/hjhbn6ycd464bm4y91xk96qxjvj4s023-gmp-6.0.0a.tar.xz
/gnu/store/bkyiyc4hrjcd4ljx6jqf7z05hm4qxcwd-mpfr-4.0.2.tar.xz
/gnu/store/j4npmpn7dxmfknyfnhj4q4jmdwmk3klg-mpc-1.1.0.tar.gz
/gnu/store/3rz13x3996wbwn214q24fqc9znfa95w2-glibc-2.31.tar.xz
/gnu/store/bqa0cad0h4a3j17y05xk3kh289q6gajp-Python-3.8.2.tar.xz
/gnu/store/3pqhpz1c3acfyfybhgr0x68vrx9zfbrv-wcwidth-0.1.8.tar.gz
/gnu/store/vfk67987393h19k12n0wsgw0d83ywzgj-six-1.14.0.tar.gz
/gnu/store/vl78s0nwcqdx36hpjlgvfc6xf6l56bgb-py-1.8.1.tar.gz
/gnu/store/dk46m54dv3i7qs1sypfif2kvwb8bsfg7-pluggy-0.13.1.tar.gz
/gnu/store/6b0idhn2x7c0dha5v8iksl09l0c29608-packaging-20.0.tar.xz
/gnu/store/j06vchvmycbgy2xy8wyd7qs43y03g6dy-more-itertools-8.2.0.tar.gz
/gnu/store/jw0knw9aafpmgxh6ph6vdbj0kzhqijr6-attrs-19.3.0.tar.gz
/gnu/store/dpa5ghk8vmsq2c2k5i7l6v69sqdxfvjd-atomicwrites-1.3.0.tar.gz
/gnu/store/0zcl1i3rbjc356138hx86b7yaz29g6fj-linux-libre-5.4.20-gnu.tar.xz
/gnu/store/aymlxbyxfm6ihpaklq0g5m8gcc1f38ay-pyparsing-2.4.6.tar.gz

Now I need to find a way to reuse the manifest we have in the pack of git-repo that I released.

In the tarball, there is the /gnu/store/mnxri377h0amdajjq2kric9li59yh77q-profile/manifest file (I've not been able to find another file that looks like a manifest).

Here's its content:

;; This file was automatically generated and is for internal use only.
;; It cannot be passed to the '--manifest' option.

(manifest
  (version 3)
  (packages
    (("git-repo" 
      "2.4.1" 
      "out" 
      "/gnu/store/d4frkcdq15a7gyfjdggwg44ryi46fa2d-git-repo-2.4.1R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("le-certs" 
      "0" 
      "out" 
      "/gnu/store/x004p4hnyy0ickg2f5msvrpszhy9hzpl-le-certs-0R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("nss-certs" 
      "3.57" 
      "out" 
      "/gnu/store/shc8qpw1y2k7q668rx4gl6aff0wp1n6v-nss-certs-3.57R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("git" 
      "2.30.0" 
      "out" 
      "/gnu/store/378nlw54nxy991jcilnnbrxasnfvv9wl-git-2.30.0R" 
      (propagated-inputs ())
      (search-paths
        (("GIT_SSL_CAINFO" 
          ("etc/ssl/certs/ca-certificates.crt")
          #f
          regular
          #f)
         ("GIT_EXEC_PATH" 
          ("libexec/git-core")
          #f
          directory
          #f)))
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("python-certifi" 
      "2020.11.8" 
      "out" 
      "/gnu/store/hmp6ab9kw1z3hjns9h1fm3afsq4g6j7x-python-certifi-2020.11.8R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"))))))))))

The issue is that "This file was automatically generated and is for internal use only. It cannot be passed to the '--manifest' option."

#7

Updated by Denis 'GNUtoo' Carikli about 2 months ago

Running make with the following Makefile:

.PHONY: all
all:
    guix time-machine \
        --commit=f9bd4621dd92a9415276706b476b9bd2973411fa -- \
        pack \
            --compression=xz \
            --save-provenance \
            -RR \
            --symlink=/usr/local/bin/repo=bin/repo \
            --symlink=/usr/local/bin/repo-env.sh=etc/profile \
            git-repo le-certs nss-certs git python-certifi

on an x86_64 computer with Guix produces the bfxvk59q0m034iyq5zkk841zkisayyjl-tarball-pack.tar.xz file in /gnu/store instead of the sz1lkq3ryr5iv6amy6f3d2pziks27g28-tarball-pack.tar.xz file.

When comparing both (with md5deep), all the binaries are the same, but the provenance file differs a bit. We have something like that as the diff, several times:

-            (branch "master")
+            (branch #f)
[...]
+            (name guix)

And the rest of the differences seems to be the consequence of that diff.

I've reported this to Guix (https://debbugs.gnu.org/cgi/bugreport.cgi?bug=49801) though I'm not 100% sure if it's a bug or if it's me not knowing how to use guix well.

In any case we can safely use guix time-machine to produce the source code to release along with that sz1lkq3ryr5iv6amy6f3d2pziks27g28-tarball-pack.tar.xz tarball as the binaries looks identical.

#8

Updated by Denis 'GNUtoo' Carikli about 2 months ago

Thanks to viven on #guix for helping me sorting that out (viven managed to build a bfxvk59q0m034iyq5zkk841zkisayyjl-tarball-pack.tar.xz file with the same name).

#9

Updated by Denis 'GNUtoo' Carikli about 2 months ago

  • Status changed from New to Closed
  • Assignee set to Denis 'GNUtoo' Carikli
  • Resolution set to fixed

The source tarball and associated README.sources.txt are ready and are being uploaded to the FTP.

Denis.

Also available in: Atom PDF