GNU bug report logs - #60629
[PATCH 0/3] Add '--with-version' package transformation

Previous Next

Full log

View this message in rfc822 format

From: Ludovic Courtès <ludo <at> gnu.org>
To: Simon Tournier <zimon.toutoune <at> gmail.com>
Cc: 60629 <at> debbugs.gnu.org, h.goebel <at> crazy-compilers.com
Subject: [bug#60629] [PATCH 0/3] Add '--with-version' package transformation
Date: Fri, 13 Jan 2023 12:12:17 +0100

Hello!

Simon Tournier <zimon.toutoune <at> gmail.com> skribis:

> On sam., 07 janv. 2023 at 16:04, Ludovic Courtès <ludo <at> gnu.org> wrote:
>
>> Now that updaters can (to some extent) import any upstream version, we
>> can provide a ‘--with-version’ package transformation option that picks
>> the given upstream version.
>
> Well, transformation bypasses the checksum control and so it is not
> really a fixed-output, right?

It’s not fixed-output at all because we don’t know in advance what we’ll
get from that download.

> Therefore, the result depends on the state of the world and thus it is
> not necessary reproducible.

Absolutely.

[...]

> All that said, this option is cool to have. :-) It is missing some
> guards, IMHO.  Maybe:
>
>  1. Wording some warning for the manual

Will do, that makes a lot of sense to me, I share your concerns.

>  2. Add comments about reproducibility when exporting manifest with
>     transformations; for example,
>
>     (define transform1
>       ;; WARNING: some transformation might lead to non-reproducible profile.
>       ;; For more details, please see the Package Transformation Options section.
>       (options->transformation
>         '((with-version . "python-numpy=1.22.4")
>           (with-c-toolchain . "python-scipy=gcc-toolchain <at> 7"))))

This one’s a bit more involved technically because we don’t use (guix
read-print) yet here, so I prefer to do that separately.

>  3. Add a warning.  Similarly, to this:
>
>    warning: cannot authenticate source of 'python-numpy', version 1.22.4
>
>    For instance,
>
>    warning: transformation for 'python-numpy' with version 1.22.4 might be non-reproducible

I wonder about this one because it would be displayed unconditionally,
there’s no “I understand the risks” button one can click to make it
disappear.  I’d lean towards making a prominent warning in the manual
and not have a warning message every time here, dunno.

Thoughts?

Thanks for your feedback!

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.