Re: Bootstrap a GNU source distribution from git

[Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>]

[-- Attachment #1: Type: text/plain, Size: 2506 bytes --]

Hi,

On Sun, 29 Sep 2024 19:52:13 +0200
Vivien Kraus <vivien@planete-kraus.eu> wrote:

> GNU sources are usually shipped as tarballs with some pre-compiled
> sources included. This can be a bit scary at times, so the question
> now is, can we skip the tarballs and build everything from
> human-authored sources?
In some cases it is also possible to build from the tarballs and also
build everything from human-authored sources.

The solution to that is to treat the generated files as things that are
not wanted during the build and just delete them before starting to
build. It's similar to tarballs which also contain the binaries of some
of their dependencies (example: .so files, often with their
corresponding source code as well for licensing compliance).

In such case the answer of the distributions is simply to delete such
binaries before the build.

The advantage of these bundled binaries is that the same tarball makes
it possible for more people to more easily build the software but it
also increase the maintenance from the distributions as they need to
find and delete such files, so to me it doesn't look ideal. Having an
easy way to automatically delete such generated files safely could be a
good idea for source tarballs releases as both uses cases could be
covered with a single tarball release.

But this also brings an interesting questions that I also had myself but
I never really had the opportunity to ask them: what is Guix policy with
regard to source code when there are multiple providers (typically git
vs tarball)?

As I understand source from version control gives us the ability to
make some package transformation option work out of the box. For
instance we have:
> $ guix build \
> --with-commit=hello=2633763362586903cf6506f4c4d708727a981025 hello
> guix build: error: the source of hello@2.12.1 is not a Git reference

So is there some (implicit or explicit) rule to always prefer the
source from version control unless it's not possible or practical (no
version control being used, too complicated to build like with GNU
hello, or the package is required for the version control to work) ?.

Since Guix also checks the hash of the source code an idea to improve
things could also be to modify Guix to allow the use of external tools
to bootstrap the download of source code through version control and
for instance download git from git. Though that could require some
substantial work and discussions.

Denis.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]