Mark H Weaver writes:

> I'm working to independently verify the new bootstrap binaries.  Toward
> that end, I locally built the new bootstrap tarballs by running the
> following command from a git checkout at commit
> ef809e3ac036eccc5f9c9edd8fb661d14ae15f2f.
>
>   ./pre-inst-env guix build bootstrap-tarballs --system=i686-linux
>
> This produces a mescc-tools-static-0.5.2-0.bb062b0-i686-linux.tar.xz
> tarball that differs from the official one.  See below for the precise
> differences, but what they boil down to is that the official tarball
> contains several references to:
>
>   /gnu/store/xjr9rv1p4vgg9sclwzsai17gqi1c1d9j-glibc-2.28
>
> Whereas in my locally built tarball, these references are instead to:
>
>   /gnu/store/ggj9164ahhn1kmdcyl3sm27qsxk46h01-glibc-2.28

Aww, that's not good :(

> First of all, I hope we can agree that our bootstrap binaries shouldn't
> include any references to the store.

I think that is our policy and it is probably safest not to do so; at
least in code.  A piece of documentation can include a string
/gnu/store/.... as long at it is static and not really a reference.

Store references in bootstrap binaries or scripts cannot be used or
depended on: if our bootstrap build is clean those references will not
exist when the bootstrap binaries run.

In any case, if store references are present in bootstrap binaries, then
they should be reproducible.  Removing store references is one way to
make them reproducible but I'm not sure if that's the best way?

Making a reference invalid helps making sure that it isn't used.  But if
it cannot be used anyway, removing it could hide the fact that it may
differs accros builds, as we are finding out right now.  Thoughts?

> However, it also raises the curious question of how I ended up with
> references to a different glibc than the one referenced by the official
> tarball.  Any idea what happened here?

Yes, that's something that I would like to know...

Anyway, I have built a new set of bootstrap binaries for mescc-tools and
mes using attched patches that remove store references (also on my
https://gitlab.com/janneke/guix core-updates).

I have just verified that tcc-boot0 builds by using this local
modification

--8<---------------cut here---------------start------------->8---
15:05:56 janneke@dundal:~/src/guix/core-updates [env]
$ git diff
diff --git a/gnu/packages/bootstrap.scm b/gnu/packages/bootstrap.scm
index 73fc7d3e5e..bca90bec94 100644
--- a/gnu/packages/bootstrap.scm
+++ b/gnu/packages/bootstrap.scm
@@ -288,7 +288,8 @@ or false to signal an error."
 
 (define %bootstrap-base-urls
   ;; This is where the initial binaries come from.
-  '("https://alpha.gnu.org/gnu/guix/bootstrap"
+  '("http://lilypond.org/janneke/guix"
+    "https://alpha.gnu.org/gnu/guix/bootstrap"
     "http://alpha.gnu.org/gnu/guix/bootstrap"
     "ftp://alpha.gnu.org/gnu/guix/bootstrap"
     "http://www.fdn.fr/~lcourtes/software/guix/packages"
--8<---------------cut here---------------end--------------->8---

and running
 
    ./pre-inst-env guix build --system=i686-linux -e '(@@ (gnu packages commencement) tcc-boot0)'

Thanks again for looking into this!

Greetings,
janneke