bug#20255: 'search-paths' should respect both user and system profile.

[Leo Prikler <leo.prikler@student.tugraz.at>]

Am Montag, den 28.06.2021, 00:35 -0400 schrieb Maxim Cournoyer:
> Hi Leo,
> 
> [...]
> 
> > I think there is a solution, that works not only for the case of
> > disabling this unwanted feature, but also to add in support for
> > multiple profiles, i.e. if the user has more than just their .guix-
> > profile to load.
> > 
> > If we made this feature opt-in in that a user would first have to
> > write
> > their profiles to $HOME/.config/guix/default-profiles or a
> > similarly
> > named file in $HOME/.config/guix, we could simply not run the
> > command
> > if the file doesn't exist, and if it exists run it using the
> > profiles
> > in there.
> > 
> > Most users will likely have
> > 
> > /home/myself/.guix-profile
> > /run/current-system/profile
> > 
> > in it, but you could also have
> > 
> > /home/myself/.guix-extra-profiles/emacs
> > /home/myself/.guix-extra-profiles/hundreds-of-npm-packages
> > /home/myself/.guix-extra-profiles/rusty-rust
> > /home/myself/.guix-profile
> > /run/current-system/profile
> > 
> > Of course, having to type out /home/myself is somewhat weird, and
> > the
> > last two lines are a bit of boilerplate, that one might want to
> > avoid. 
> > We could alternatively make it so that an empty file means "use
> > $HOME/.guix-profile and /run/current-system/profile", such that
> > those
> > are always sourced no matter what.  WDYT?
> 
> I like this later idea (does what a user would reasonably expect by
> default, which is to consider both the system and the user profile by
> default).  A user specifying that file manually could then override
> the
> default behavior to have it source extra profiles, or none at all.
> 
> Some small difference I'd propose:
> 
> An non-existing $HOME/.config/guix/default-profiles file would be
> equivalent to an existing file containing:
> 
> - $HOME/.guix-profile
> - /run/current-system/profile
> 
> as the default behavior.
The behaviour for a missing default-profiles is nothing so as to
address the concerns raised by Alex Kost about running the guix binary
without the user's consent.  It still runs external binaries such as
test, but IIRC those are already run in our existing setup, so that's
not really a concern worth raising.

I do agree, that your solution is more reasonable if there's nothing
else to consider.

> Now we'd need to look at how feasible it is to implement such a
> feature.
A naïve implementation would be a pipe with sed and xargs, but I don't
know how well that'd guard against shell code exploits.  A more
complicated approach might take a few lines of shell code, but I don't
think it would be excessively large.

> Thanks for this clever suggestion!  It seems we may be able to find a
> good middle ground :-).
> 
> Maxim