roadmap item

roadmap item

[ng0]

Hi,

can we add something to the roadmap like this:

- guix package --search should displays if the returned packages one
  asked for are reproducible.

Having a distinction between reproducible and not reproducible would
enable us (or at least help us) to display the progress towards a fully
reproducible system.
-- 
               ng0
#.endofsubmission.

Re: roadmap item

[John Darrington]

[-- Attachment #1: Type: text/plain, Size: 1024 bytes --]

On Fri, Sep 30, 2016 at 12:15:28PM +0000, ng0 wrote:
     Hi,
     
     can we add something to the roadmap like this:
     
     - guix package --search should displays if the returned packages one
       asked for are reproducible.
     
     Having a distinction between reproducible and not reproducible would
     enable us (or at least help us) to display the progress towards a fully
     reproducible system.


I don't see how anyone can say that package X is definitely reproducible.
Just because it built identically twice, doesn't mean that it'll happen
again the third time - especially if that attempt is on a different 
machine, day-of-week etc

Perhaps there could be a flag to indicate "this derivation has been demonstrated
NOT to be reproducible".

J'

-- 
Avoid eavesdropping.  Send strong encrypted email.
PGP Public key ID: 1024D/2DE827B3 
fingerprint = 8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: roadmap item

[ng0]

John Darrington <john@darrington.wattle.id.au> writes:

> [ Unknown signature status ]
> On Fri, Sep 30, 2016 at 12:15:28PM +0000, ng0 wrote:
>      Hi,
>      
>      can we add something to the roadmap like this:
>      
>      - guix package --search should displays if the returned packages one
>        asked for are reproducible.
>      
>      Having a distinction between reproducible and not reproducible would
>      enable us (or at least help us) to display the progress towards a fully
>      reproducible system.
>
>
> I don't see how anyone can say that package X is definitely reproducible.
> Just because it built identically twice, doesn't mean that it'll happen
> again the third time - especially if that attempt is on a different 
> machine, day-of-week etc
>
> Perhaps there could be a flag to indicate "this derivation has been demonstrated
> NOT to be reproducible".

That should be more like what I wanted to express with this, the NOT
part. For more read below.

> J'
>
> -- 
> Avoid eavesdropping.  Send strong encrypted email.
> PGP Public key ID: 1024D/2DE827B3 
> fingerprint = 8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3
> See http://sks-keyservers.net or any PGP keyserver for public key.
>

There's something I have been discussing with other people, and there's
a social component I want to add. It should be trivial at some point to
establish a system based on the social graph
(http://secushare.org/security) where people who build the software can
certify that version Z of package X at point Y in time did build N times
without changing results. Of course that's the future, and there's more
than just an idea, but it's not documented anywhere public so far.

We could of course try to establish something similar already, based on
the results of different hydras already running and building 24/7, on
different hardware, different systems and building different packages
already on different times and days of the week. The progress of
publishing these results should not be entirely automated.

Re: roadmap item

[Eric Bavier]

On 2016-09-30 07:15, ng0 wrote:
> Hi,
> 
> can we add something to the roadmap like this:
> 
> - guix package --search should displays if the returned packages one
>   asked for are reproducible.
> 
> Having a distinction between reproducible and not reproducible would
> enable us (or at least help us) to display the progress towards a fully
> reproducible system.

There are two distinctions that need to be made:

1. The package builds on a single machine with `guix build 
--no-substitutes --rounds=N foo`.

2. The result of `guix challenge foo` is clean.

As noted in "Invoking 'guix challenge'", the latter requires the former, 
but both would be interesting to test, catalog, and display.

-- 
`~Eric