Subject: bug#31285: closed (Re: bug#31285: [PATCH 0/1] guix: Add git-fetch/impure.)

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 14 Jul 2021 09:24:02 +0000

Your bug report

#31285: [PATCH 0/1] guix: Add git-fetch/impure.

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
31285: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=31285
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#31285: [PATCH 0/1] guix: Add git-fetch/impure.
From: Chris Marusich <[email-masked]>
To: Luis Felipe <[email-masked]>
Cc: [email-masked]
Date: Wed, 14 Jul 2021 02:23:44 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

Luis Felipe <[email-masked]> writes:

>> Sometimes, a Git repository may only be available via an authenticatedSSH connection. Even in the case of repositories that only containfree software, this situation can arise for administrative orcompliance-related reasons. How can one define a package in such asituation?
>
>
> Correct me if I'm wrong, but I think this is possible now. All you have to do is pass a git-checkout record to the package source field instead of an origin (see the (guix git) module). For example:
>
> (source
>  (git-checkout
>   (url "[email-masked]:luis-felipe/guile-lab.git")
>   (commit (string-append "v" version))))
>
> I'm using this for my private packages, and it seems to work.

Yes, this does work.  Combined with the fact that it is now possible to
"guix pull" channels over SSH, there is no need for this patch any more.
The "git-checkout" gexp-compiler basically does the same thing that I
was trying to do (it is still "impure" in that the fetching happens
outside the store), but it does it more elegantly.

I'm closing this report.

-- 
Chris

Subject: [PATCH 0/1] guix: Add git-fetch/impure.
From: Chris Marusich <[email-masked]>
To: [email-masked]
Cc: Chris Marusich <[email-masked]>
Date: Fri, 27 Apr 2018 01:15:20 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi Guix!

Sometimes, a Git repository may only be available via an authenticated
SSH connection.  Even in the case of repositories that only contain
free software, this situation can arise for administrative or
compliance-related reasons.  How can one define a package in such a
situation?

This patch adds a new origin method, git-fetch/impure, which solves
that problem.  Specifically, git-fetch/impure creates a fixed-output
derivation that fetches the Git repository outside of a derivation, in
the environment of the invoking user.  In particular, this enables SSH
to communicate with the user's SSH agent, which in turn allows Git to
fetch the repository over an authenticated SSH connection.  In
addition, because it is a fixed-output derivation, the output of a
successful git-fetch/impure is guaranteed to be identical to the
output of a pure git-fetch for any given commit.

Here's a simple example:

(define-public guix-over-ssh
  (package
    (inherit guix)
    (name "guix-over-ssh")
    (source
     (origin
       (inherit (package-source guix))
       (method git-fetch/impure)
       (uri
        (git-reference
         (inherit (origin-uri (package-source guix)))
         (url "ssh://[email-masked]:/srv/git/guix.git")))))))

In this particular example, my username appears in the package
definition, but there is no reason why that has to be so.  In many
systems, it is possible to grant access to multiple users with
different SSH keys under a single shared user name.  And in other
systems, an automated build system might need to fetch sources using
its own unique system user name and SSH key.

All in all, I think this is pretty useful.  It enables developers to
define packages in environments where authenticated access to Git
repositories is required.  Please let me know what you think!

Chris Marusich (1):
  guix: Add git-fetch/impure.

 doc/guix.texi         |  24 +++++++
 guix/git-download.scm | 150 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 174 insertions(+)

-- 
2.17.0