[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug#60629] [PATCH 0/3] Add '--with-version' package transformation
From: |
Ludovic Courtès |
Subject: |
[bug#60629] [PATCH 0/3] Add '--with-version' package transformation |
Date: |
Fri, 13 Jan 2023 12:12:17 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) |
Hello!
Simon Tournier <zimon.toutoune@gmail.com> skribis:
> On sam., 07 janv. 2023 at 16:04, Ludovic Courtès <ludo@gnu.org> wrote:
>
>> Now that updaters can (to some extent) import any upstream version, we
>> can provide a ‘--with-version’ package transformation option that picks
>> the given upstream version.
>
> Well, transformation bypasses the checksum control and so it is not
> really a fixed-output, right?
It’s not fixed-output at all because we don’t know in advance what we’ll
get from that download.
> Therefore, the result depends on the state of the world and thus it is
> not necessary reproducible.
Absolutely.
[...]
> All that said, this option is cool to have. :-) It is missing some
> guards, IMHO. Maybe:
>
> 1. Wording some warning for the manual
Will do, that makes a lot of sense to me, I share your concerns.
> 2. Add comments about reproducibility when exporting manifest with
> transformations; for example,
>
> (define transform1
> ;; WARNING: some transformation might lead to non-reproducible profile.
> ;; For more details, please see the Package Transformation Options
> section.
> (options->transformation
> '((with-version . "python-numpy=1.22.4")
> (with-c-toolchain . "python-scipy=gcc-toolchain@7"))))
This one’s a bit more involved technically because we don’t use (guix
read-print) yet here, so I prefer to do that separately.
> 3. Add a warning. Similarly, to this:
>
> warning: cannot authenticate source of 'python-numpy', version 1.22.4
>
> For instance,
>
> warning: transformation for 'python-numpy' with version 1.22.4 might be
> non-reproducible
I wonder about this one because it would be displayed unconditionally,
there’s no “I understand the risks” button one can click to make it
disappear. I’d lean towards making a prominent warning in the manual
and not have a warning message every time here, dunno.
Thoughts?
Thanks for your feedback!
Ludo’.