Replicant

We now ship repo to be able to still build Replicant 6: https://ftp.osuosl.org/pub/replicant/build-tools/

Wile Guix tarballs should be reproducible, and that everything is documented to produce the same tarball (we have a manifest inside, the commands used to do it are in the README.txt, and the source code archives are even backed up by Heritage, and Guix knowns how to fetch them), we probably still need to provide the repo source code along with the source code of other dependencies as per the GPLv2 :

If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.

On #guix, I was told that I could use the following command to get all the corresponding source code:

$ guix build --sources=transitive git-repo
/gnu/store/z2xswqmxqxfqr86yfmgk4468np6mlsn8-pytest-5.3.5.tar.gz
/gnu/store/3bpy0k170ls57j7iaka035d2ad2vqhvw-git-repo-2.4.1-checkout
/gnu/store/7ydrhd1l4ml9lr1jds9iwqkafb9krgry-git-2.31.1.tar.xz
/gnu/store/zc51ka7ywcgsnafx2mnpa25m1yxnf7pq-git-manpages-2.31.1.tar.xz
/gnu/store/6fpff85100i1inlmmbgn5n62v8372wl8-openssh-8.6p1.tar.xz
/gnu/store/hf8ks3jmhgxy5nab2ml4lbascgxmjriq-tar-1.32.tar.xz
/gnu/store/5dh059d365953arhixlx4xqkngwv2jmr-gzip-1.10.tar.xz
/gnu/store/q5sqgng4wdzxr6yrvvp706kbxa3fcfjf-bzip2-1.0.8.tar.gz
/gnu/store/qa3sp0f1qpqhrzb0v9y5kfgyr61dh70r-xz-5.2.4.tar.gz
/gnu/store/vn2va1z43xkd1qxb1ydbc4934gl6kzz9-file-5.38.tar.gz
/gnu/store/l4qq4a2vzh0jv7bvmm18vwx04qawnx44-diffutils-3.7.tar.xz
/gnu/store/9dd0y2li21gnvgqj6ic9cpdci34gllyy-patch-2.7.6.tar.xz
/gnu/store/6xll0wcqhxj121xbc74svhdf94wq4smz-findutils-4.7.0.tar.xz
/gnu/store/l9vhv074g8m4zqc420d6d21qm21a6ggw-gawk-5.0.1.tar.xz
/gnu/store/9389fg6fgqdl1kgyyd2pz2qw6194cs7v-sed-4.8.tar.gz
/gnu/store/53xsnszbz9vxcz5yh6as0jcx5r39llg0-grep-3.4.tar.xz
/gnu/store/ba4d1lp4mbcb99klnyxnzjv0yncjp29x-coreutils-8.32.tar.xz
/gnu/store/92aasjpjaaxmnxvzpgzzr4bs1n9l7w5f-make-4.3.tar.xz
/gnu/store/sdvchr0j39imynn7barz16z51gfiggn5-bash-5.0.tar.xz
/gnu/store/89a7hma91jf6bx052y05jhi9px7icjkx-binutils-2.34.tar.xz
/gnu/store/bqbblvdhswy94l0d5mir7l7c2a49qv7h-gcc-7.5.0.tar.xz
/gnu/store/hjhbn6ycd464bm4y91xk96qxjvj4s023-gmp-6.0.0a.tar.xz
/gnu/store/bkyiyc4hrjcd4ljx6jqf7z05hm4qxcwd-mpfr-4.0.2.tar.xz
/gnu/store/j4npmpn7dxmfknyfnhj4q4jmdwmk3klg-mpc-1.1.0.tar.gz
/gnu/store/3rz13x3996wbwn214q24fqc9znfa95w2-glibc-2.31.tar.xz
/gnu/store/bqa0cad0h4a3j17y05xk3kh289q6gajp-Python-3.8.2.tar.xz
/gnu/store/3pqhpz1c3acfyfybhgr0x68vrx9zfbrv-wcwidth-0.1.8.tar.gz
/gnu/store/vfk67987393h19k12n0wsgw0d83ywzgj-six-1.14.0.tar.gz
/gnu/store/vl78s0nwcqdx36hpjlgvfc6xf6l56bgb-py-1.8.1.tar.gz
/gnu/store/dk46m54dv3i7qs1sypfif2kvwb8bsfg7-pluggy-0.13.1.tar.gz
/gnu/store/6b0idhn2x7c0dha5v8iksl09l0c29608-packaging-20.0.tar.xz
/gnu/store/j06vchvmycbgy2xy8wyd7qs43y03g6dy-more-itertools-8.2.0.tar.gz
/gnu/store/jw0knw9aafpmgxh6ph6vdbj0kzhqijr6-attrs-19.3.0.tar.gz
/gnu/store/dpa5ghk8vmsq2c2k5i7l6v69sqdxfvjd-atomicwrites-1.3.0.tar.gz
/gnu/store/0zcl1i3rbjc356138hx86b7yaz29g6fj-linux-libre-5.4.20-gnu.tar.xz
/gnu/store/aymlxbyxfm6ihpaklq0g5m8gcc1f38ay-pyparsing-2.4.6.tar.gz

Now I need to find a way to reuse the manifest we have in the pack of git-repo that I released.

In the tarball, there is the /gnu/store/mnxri377h0amdajjq2kric9li59yh77q-profile/manifest file (I've not been able to find another file that looks like a manifest).

Here's its content:

;; This file was automatically generated and is for internal use only.
;; It cannot be passed to the '--manifest' option.

(manifest
  (version 3)
  (packages
    (("git-repo" 
      "2.4.1" 
      "out" 
      "/gnu/store/d4frkcdq15a7gyfjdggwg44ryi46fa2d-git-repo-2.4.1R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("le-certs" 
      "0" 
      "out" 
      "/gnu/store/x004p4hnyy0ickg2f5msvrpszhy9hzpl-le-certs-0R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("nss-certs" 
      "3.57" 
      "out" 
      "/gnu/store/shc8qpw1y2k7q668rx4gl6aff0wp1n6v-nss-certs-3.57R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("git" 
      "2.30.0" 
      "out" 
      "/gnu/store/378nlw54nxy991jcilnnbrxasnfvv9wl-git-2.30.0R" 
      (propagated-inputs ())
      (search-paths
        (("GIT_SSL_CAINFO" 
          ("etc/ssl/certs/ca-certificates.crt")
          #f
          regular
          #f)
         ("GIT_EXEC_PATH" 
          ("libexec/git-core")
          #f
          directory
          #f)))
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))))
     ("python-certifi" 
      "2020.11.8" 
      "out" 
      "/gnu/store/hmp6ab9kw1z3hjns9h1fm3afsq4g6j7x-python-certifi-2020.11.8R" 
      (propagated-inputs ())
      (search-paths ())
      (properties
        (provenance
          (repository
            (version 0)
            (url "https://git.savannah.gnu.org/git/guix.git")
            (branch "master")
            (commit
              "f9bd4621dd92a9415276706b476b9bd2973411fa")
            (introduction
              (channel-introduction
                (version 0)
                (commit
                  "9edb3f66fd807b096b48283debdcddccfea34bad")
                (signer
                  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"))))))))))

The issue is that "This file was automatically generated and is for internal use only. It cannot be passed to the '--manifest' option."

Running make with the following Makefile:

.PHONY: all
all:
    guix time-machine \
        --commit=f9bd4621dd92a9415276706b476b9bd2973411fa -- \
        pack \
            --compression=xz \
            --save-provenance \
            -RR \
            --symlink=/usr/local/bin/repo=bin/repo \
            --symlink=/usr/local/bin/repo-env.sh=etc/profile \
            git-repo le-certs nss-certs git python-certifi

When comparing both (with md5deep), all the binaries are the same, but the provenance file differs a bit. We have something like that as the diff, several times:

-            (branch "master")
+            (branch #f)
[...]
+            (name guix)

And the rest of the differences seems to be the consequence of that diff.

I've reported this to Guix (https://debbugs.gnu.org/cgi/bugreport.cgi?bug=49801) though I'm not 100% sure if it's a bug or if it's me not knowing how to use guix well.

In any case we can safely use guix time-machine to produce the source code to release along with that sz1lkq3ryr5iv6amy6f3d2pziks27g28-tarball-pack.tar.xz tarball as the binaries looks identical.

Thanks to viven on #guix for helping me sorting that out (viven managed to build a bfxvk59q0m034iyq5zkk841zkisayyjl-tarball-pack.tar.xz file with the same name).