bug#46849: ELPA packages are fetched from unstable url -> not reproducible

[zimoun <zimon.toutoune@gmail.com>]

Follow up 3.

-------------------- Start of forwarded message --------------------
From: zimoun <zimon.toutoune@gmail.com>
To: Johannes Rosenberger <johannes@jorsn.eu>
Subject: Re: bug#46849: ELPA packages are fetched from unstable url -> not
 reproducible
Date: Fri, 05 Mar 2021 13:31:09 +0100

Hi Johannes,

On Fri, 05 Mar 2021 at 13:08, Johannes Rosenberger <johannes@jorsn.eu> wrote:

>>> There is 2 solutions:
>>>
>>>  1- trust the future Tarball Heritage [1]
>>>  2- switch to git-fetch all the ELPA packages.
>>   3- trust archive.org

About archive.org, I do not know.  Currently, there is no fallback in
Guix to it that I am aware, and nothing planned AFAIK.

> and maybe a fourth one:
>
>     4- https://www.softwareheritage.org/
>        (Blog entry about Nix & this by Tweag: https://www.softwareheritage.org/)

Yeah, this is what I called #1. :-) Currently, via the ’nixguix’ SWH
loader [1], packages using url-fetch are archived via the file [2].
However, work remains to have a full robust end-to-end solution:

  a) not all the extensions of ’url-fetch’ are archived (and I do not
remember the status about the .el)

  b) the fallback is not robust because of inconsistent addresses
between SWH (swh-id) and the-rest-of-the-world (checksum hashes)–to say
it quickly.

The aim of the disarchive’s project [3] is to address b) by creating a
bridge, i.e., stores in a separate database [4] the structure of the
metadata and then rebuild the archive from a checksum using the files
addressed by swh-id.


1: <https://docs.softwareheritage.org/devel/_modules/swh/loader/package/nixguix.html>
2: <http://guix.gnu.org/sources.json>
3: <https://git.ngyro.com/disarchive>
4: <https://git.ngyro.com/disarchive-db/>


Cheers,
simon
-------------------- End of forwarded message --------------------