Subject: Re: [bug#55231] Understanding #:substitutable? and #55231

From: Morgan Arnold <[email-masked]>
Date: Fri, 14 Feb 2025 16:10:22 +0000

Hi Leo,

Thanks for your interest!

> If it is the case, then I don't think that Guix needs to do anything
> about this except prevent our CI infrastructure from building the ZFS
> module. We wouldn't need to hardcode any restrictions into the Guix
> codebase. We have created these kinds of CI restrictions in the past.

I think that Maxime has argued against the idea that this is a sufficient guardrail. To (hopefully accurately) summarize Maxime's position, the issue is not simply preventing Guix's CI infrastructure from serving the combined work, but that this change would make it easier for users of Guix to accidentally serve the combined work by use of `guix publish`. Maxime's position is, to the best of my understanding, that this change should not be introduced to Guix, as it makes it easier for an end user to accidentally commit a copyright violation. If I have misrepresented Maxime's position here, I would welcome a correction.

I personally believe that the odds of a user accidentally committing a copyright violation due to this change are sufficiently low that it would be acceptable to merge the patch as-is, but reasonable minds can and of course do differ on this point. My attempts to make `#:substitutable? #f` "poisoning" are an attempt to fix this, but I have found that my lack of experience has made it difficult for me to figure out how to test that this change is behaving appropriately. It currently seems that more packages than I expected are "poisoned" for reasons that I do not really understand. Any help with understanding this would be hugely appreciated.

> Already it's possible to create combinations of programs with
> incompatible free software licenses, as a user. Is this particular
> combination (ZFS and Linux) special in some way?

As discussed (in particular by Ian), it is already very possible to commit copyright violations with Guix. Maxime's concern seems to me to be more about the fact that this change facilitates (and arguably encourages) the accidental commission of copyright violations. This issue is not necessarily specific to Linux+ZFS, but is the primary example being discussed because facilitating Linux+ZFS systems would be a major application of this patch.

Best,

Morgan

P.S. In my proposed patch to `derivation`, I accidentally fat-fingered an extra closing parenthesis at the end of the changed line. I haven't bothered to submit a v6 of the patch set which fixes this, since I'm not sure if the corrected version of the patch even works as intended (or, if it is working as intended, why so many more packages than expected seem to be poisoned).