Subject: Re: [bug#70314] [PATCH] guix: scripts: environment: add tls certs to networked containers

From: Richard Sent <[email-masked]>
Date: Mon, 16 Sep 2024 11:22:03 -0400

Ludovic Courtès <[email-masked]> writes:

> Can we delay changes to the manifest until after all options have been
> parsed, so we know whether ‘-C’ has been passed?
> 
> That way ‘guix shell -N --no-tls’ does not add ‘nss-certs’ to the
> environments.

Is `$ guix shell -N -- true` valid? I know it works at present, but my
understanding is sharing the network only works with containers. From
the manual:

> ‘--network’
> ‘-N’
>      For containers, share the network namespace with the host system.
>      Containers created without this flag only have access to the
>      loopback device.

Perhaps instead we should error when -N is passed without -C, ala

--8<---------------cut here---------------start------------->8---
modified   guix/scripts/environment.scm
@@ -1153,7 +1153,9 @@ (define (guix-environment* opts)
       (when nesting?
         (leave (G_ "'--nesting' cannot be used without '--container'~%")))
       (when (pair? symlinks)
-        (leave (G_ "'--symlink' cannot be used without '--container'~%"))))
+        (leave (G_ "'--symlink' cannot be used without '--container'~%")))
+      (when network?
+        (leave (G_ "'--network cannot be used without '--container'~%"))))
 
     (when (and (not network?)
                no-tls?)
--8<---------------cut here---------------end--------------->8---

-- 
Take it easy,
Richard Sent
Making my computer weirder one commit at a time.