Re: Fedora/Debian release monitoring inspiration for Guix Data Service

["Ludovic Courtès" <ludo@gnu.org>]

Hi,

Léo Le Bouter <lle-bout@zaclys.net> skribis:

> It seems Fedora has automated infrastructure and feeds to monitor new
> upstream releases so that maintainers can get notifications on them.
>
> https://release-monitoring.org/

Established distros have great tools and services for that.

Guix has ‘guix refresh’, which predates some of the trendy release/CVE
monitoring services and actually works well.  It’s not perfect, but it’s
good, so my advice would be to work on improving it.

If you look at Guix’s design and history, you’ll find that much is built
in a way that avoids relying on external services when we can.

> We could even go as far as preparing a patch (similar to guix refresh
> -u <pkg> && etc/committer.scm) and trying to build it and all it's
> dependents and if it doesnt cause any new failures we could send an
> automated patch contribution on guix-patches directly and tag it with
> "ci-update-ok" or something so a maintainer just has to double-check
> quickly and push (very efficient workflow). 

I definitely agree.  We could build upon the infrastructure we already
have to write a tool that roughly runs ‘guix refresh -u’ on individual
packages, attempts to build it and its dependents, and publishes a
ready-to-apply patch—or a failure notification.

Whether it’s a task for the Guix Data Service or some other service, I
don’t know, but it would be most welcome!

Ludo’.