Hi, On Sun, 29 Sep 2024 19:52:13 +0200 Vivien Kraus wrote: > GNU sources are usually shipped as tarballs with some pre-compiled > sources included. This can be a bit scary at times, so the question > now is, can we skip the tarballs and build everything from > human-authored sources? In some cases it is also possible to build from the tarballs and also build everything from human-authored sources. The solution to that is to treat the generated files as things that are not wanted during the build and just delete them before starting to build. It's similar to tarballs which also contain the binaries of some of their dependencies (example: .so files, often with their corresponding source code as well for licensing compliance). In such case the answer of the distributions is simply to delete such binaries before the build. The advantage of these bundled binaries is that the same tarball makes it possible for more people to more easily build the software but it also increase the maintenance from the distributions as they need to find and delete such files, so to me it doesn't look ideal. Having an easy way to automatically delete such generated files safely could be a good idea for source tarballs releases as both uses cases could be covered with a single tarball release. But this also brings an interesting questions that I also had myself but I never really had the opportunity to ask them: what is Guix policy with regard to source code when there are multiple providers (typically git vs tarball)? As I understand source from version control gives us the ability to make some package transformation option work out of the box. For instance we have: > $ guix build \ > --with-commit=hello=2633763362586903cf6506f4c4d708727a981025 hello > guix build: error: the source of hello@2.12.1 is not a Git reference So is there some (implicit or explicit) rule to always prefer the source from version control unless it's not possible or practical (no version control being used, too complicated to build like with GNU hello, or the package is required for the version control to work) ?. Since Guix also checks the hash of the source code an idea to improve things could also be to modify Guix to allow the use of external tools to bootstrap the download of source code through version control and for instance download git from git. Though that could require some substantial work and discussions. Denis.