Project

General

Profile

Actions

Issue #2225

closed

Find how to ship source code with guix pack

Added by Denis 'GNUtoo' Carikli almost 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Category:
Legal
Target version:
-
Start date:
02/25/2021
Due date:
% Done:

0%

Estimated time:
Resolution:
fixed
Device:
Not device specific
Grant:
Type of work:
Communication (mails, contacting people, etc), Lisp programming and/or work on Guix
Actions #1

Updated by Denis 'GNUtoo' Carikli almost 2 years ago

We now ship repo to be able to still build Replicant 6: https://ftp.osuosl.org/pub/replicant/build-tools/

Wile Guix tarballs should be reproducible, and that everything is documented to produce the same tarball (we have a manifest inside, the commands used to do it are in the README.txt, and the source code archives are even backed up by Heritage, and Guix knowns how to fetch them), we probably still need to provide the repo source code along with the source code of other dependencies as per the GPLv2 :

If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.

Actions #2

Updated by Denis 'GNUtoo' Carikli over 1 year ago

  • Type of work Lisp programming and/or work on Guix added
Actions #3

Updated by Denis 'GNUtoo' Carikli over 1 year ago

  • Device Not device specific added
  • Device deleted (Unknown)
Actions #4

Updated by Denis 'GNUtoo' Carikli over 1 year ago

  • Type of work Communication (mails, contacting people, etc) added
Actions #5

Updated by Denis 'GNUtoo' Carikli over 1 year ago

  • Category changed from Freedom to Legal
Actions #6

Updated by Denis 'GNUtoo' Carikli over 1 year ago

On #guix, I was told that I could use the following command to get all the corresponding source code:

$ guix build --sources=transitive git-repo
/gnu/store/z2xswqmxqxfqr86yfmgk4468np6mlsn8-pytest-5.3.5.tar.gz
/gnu/store/3bpy0k170ls57j7iaka035d2ad2vqhvw-git-repo-2.4.1-checkout
/gnu/store/7ydrhd1l4ml9lr1jds9iwqkafb9krgry-git-2.31.1.tar.xz
/gnu/store/zc51ka7ywcgsnafx2mnpa25m1yxnf7pq-git-manpages-2.31.1.tar.xz
/gnu/store/6fpff85100i1inlmmbgn5n62v8372wl8-openssh-8.6p1.tar.xz
/gnu/store/hf8ks3jmhgxy5nab2ml4lbascgxmjriq-tar-1.32.tar.xz
/gnu/store/5dh059d365953arhixlx4xqkngwv2jmr-gzip-1.10.tar.xz
/gnu/store/q5sqgng4wdzxr6yrvvp706kbxa3fcfjf-bzip2-1.0.8.tar.gz
/gnu/store/qa3sp0f1qpqhrzb0v9y5kfgyr61dh70r-xz-5.2.4.tar.gz
/gnu/store/vn2va1z43xkd1qxb1ydbc4934gl6kzz9-file-5.38.tar.gz
/gnu/store/l4qq4a2vzh0jv7bvmm18vwx04qawnx44-diffutils-3.7.tar.xz
/gnu/store/9dd0y2li21gnvgqj6ic9cpdci34gllyy-patch-2.7.6.tar.xz
/gnu/store/6xll0wcqhxj121xbc74svhdf94wq4smz-findutils-4.7.0.tar.xz
/gnu/store/l9vhv074g8m4zqc420d6d21qm21a6ggw-gawk-5.0.1.tar.xz
/gnu/store/9389fg6fgqdl1kgyyd2pz2qw6194cs7v-sed-4.8.tar.gz
/gnu/store/53xsnszbz9vxcz5yh6as0jcx5r39llg0-grep-3.4.tar.xz
/gnu/store/ba4d1lp4mbcb99klnyxnzjv0yncjp29x-coreutils-8.32.tar.xz
/gnu/store/92aasjpjaaxmnxvzpgzzr4bs1n9l7w5f-make-4.3.tar.xz
/gnu/store/sdvchr0j39imynn7barz16z51gfiggn5-bash-5.0.tar.xz
/gnu/store/89a7hma91jf6bx052y05jhi9px7icjkx-binutils-2.34.tar.xz
/gnu/store/bqbblvdhswy94l0d5mir7l7c2a49qv7h-gcc-7.5.0.tar.xz
/gnu/store/hjhbn6ycd464bm4y91xk96qxjvj4s023-gmp-6.0.0a.tar.xz
/gnu/store/bkyiyc4hrjcd4ljx6jqf7z05hm4qxcwd-mpfr-4.0.2.tar.xz
/gnu/store/j4npmpn7dxmfknyfnhj4q4jmdwmk3klg-mpc-1.1.0.tar.gz
/gnu/store/3rz13x3996wbwn214q24fqc9znfa95w2-glibc-2.31.tar.xz
/gnu/store/bqa0cad0h4a3j17y05xk3kh289q6gajp-Python-3.8.2.tar.xz
/gnu/store/3pqhpz1c3acfyfybhgr0x68vrx9zfbrv-wcwidth-0.1.8.tar.gz
/gnu/store/vfk67987393h19k12n0wsgw0d83ywzgj-six-1.14.0.tar.gz
/gnu/store/vl78s0nwcqdx36hpjlgvfc6xf6l56bgb-py-1.8.1.tar.gz
/gnu/store/dk46m54dv3i7qs1sypfif2kvwb8bsfg7-pluggy-0.13.1.tar.gz
/gnu/store/6b0idhn2x7c0dha5v8iksl09l0c29608-packaging-20.0.tar.xz
/gnu/store/j06vchvmycbgy2xy8wyd7qs43y03g6dy-more-itertools-8.2.0.tar.gz
/gnu/store/jw0knw9aafpmgxh6ph6vdbj0kzhqijr6-attrs-19.3.0.tar.gz
/gnu/store/dpa5ghk8vmsq2c2k5i7l6v69sqdxfvjd-atomicwrites-1.3.0.tar.gz
/gnu/store/0zcl1i3rbjc356138hx86b7yaz29g6fj-linux-libre-5.4.20-gnu.tar.xz
/gnu/store/aymlxbyxfm6ihpaklq0g5m8gcc1f38ay-pyparsing-2.4.6.tar.gz

Now I need to find a way to reuse the manifest we have in the pack of git-repo that I released.

In the tarball, there is the /gnu/store/mnxri377h0amdajjq2kric9li59yh77q-profile/manifest file (I've not been able to find another file that looks like a manifest).

Here's its content:

;; This file was automatically generated and is for internal use only.
;; It cannot be passed to the '--manifest' option.

(manifest
  (version 3)
  (packages
    (("git-repo" 
      "2.4.1" 
      "out" 
      "/gnu/store/d4frkcdq15a7gyfjdggwg44ryi46fa2d-git-repo-2.4.1R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("le-certs" 
      "0" 
      "out" 
      "/gnu/store/x004p4hnyy0ickg2f5msvrpszhy9hzpl-le-certs-0R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("nss-certs" 
      "3.57" 
      "out" 
      "/gnu/store/shc8qpw1y2k7q668rx4gl6aff0wp1n6v-nss-certs-3.57R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("git" 
      "2.30.0" 
      "out" 
      "/gnu/store/378nlw54nxy991jcilnnbrxasnfvv9wl-git-2.30.0R" 
      (propagated-inputs ())
      (search-paths
        (("GIT_SSL_CAINFO" 
          ("etc/ssl/certs/ca-certificates.crt")
          #f
          regular
          #f)
         ("GIT_EXEC_PATH" 
          ("libexec/git-core")
          #f
          directory
          #f)))
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("python-certifi" 
      "2020.11.8" 
      "out" 
      "/gnu/store/hmp6ab9kw1z3hjns9h1fm3afsq4g6j7x-python-certifi-2020.11.8R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"))))))))))

The issue is that "This file was automatically generated and is for internal use only. It cannot be passed to the '--manifest' option."

Actions #7

Updated by Denis 'GNUtoo' Carikli over 1 year ago

Running make with the following Makefile:

.PHONY: all
all:
    guix time-machine \
        --commit=f9bd4621dd92a9415276706b476b9bd2973411fa -- \
        pack \
            --compression=xz \
            --save-provenance \
            -RR \
            --symlink=/usr/local/bin/repo=bin/repo \
            --symlink=/usr/local/bin/repo-env.sh=etc/profile \
            git-repo le-certs nss-certs git python-certifi

on an x86_64 computer with Guix produces the bfxvk59q0m034iyq5zkk841zkisayyjl-tarball-pack.tar.xz file in /gnu/store instead of the sz1lkq3ryr5iv6amy6f3d2pziks27g28-tarball-pack.tar.xz file.

When comparing both (with md5deep), all the binaries are the same, but the provenance file differs a bit. We have something like that as the diff, several times:

-            (branch "master")
+            (branch #f)
[...]
+            (name guix)

And the rest of the differences seems to be the consequence of that diff.

I've reported this to Guix (https://debbugs.gnu.org/cgi/bugreport.cgi?bug=49801) though I'm not 100% sure if it's a bug or if it's me not knowing how to use guix well.

In any case we can safely use guix time-machine to produce the source code to release along with that sz1lkq3ryr5iv6amy6f3d2pziks27g28-tarball-pack.tar.xz tarball as the binaries looks identical.

Actions #8

Updated by Denis 'GNUtoo' Carikli over 1 year ago

Thanks to viven on #guix for helping me sorting that out (viven managed to build a bfxvk59q0m034iyq5zkk841zkisayyjl-tarball-pack.tar.xz file with the same name).

Actions #9

Updated by Denis 'GNUtoo' Carikli over 1 year ago

  • Status changed from New to Closed
  • Assignee set to Denis 'GNUtoo' Carikli
  • Resolution set to fixed

The source tarball and associated README.sources.txt are ready and are being uploaded to the FTP.

Denis.

Actions

Also available in: Atom PDF