From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: A registry for distributed sources and binaries Date: Mon, 25 Jul 2016 11:21:43 +0200 Message-ID: <87eg6iqdi0.fsf@gnu.org> References: <579027b7.VHXjhpPxQC3AAmeY%pjotr.public12@email> <8760rznoh1.fsf@gnu.org> <20160722004130.GA10340@thebird.nl> <874m7hk6dz.fsf_-_@gnu.org> <20160724033027.GA20236@thebird.nl> <87wpka7p0g.fsf@elephly.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48976) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bRc5A-0005DR-0y for guix-devel@gnu.org; Mon, 25 Jul 2016 05:21:53 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bRc55-0007cy-0E for guix-devel@gnu.org; Mon, 25 Jul 2016 05:21:50 -0400 In-Reply-To: <87wpka7p0g.fsf@elephly.net> (Ricardo Wurmus's message of "Sun, 24 Jul 2016 22:35:43 +0200") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ricardo Wurmus Cc: guix-devel@gnu.org Hello, Ricardo Wurmus skribis: > Currently, GUIX_PACKAGE_PATH depends on some manual work to be done > first. Finding a third-party repository, downloading it, updating it > separately from Guix itself (it won=E2=80=99t get updated via =E2=80=9Cgu= ix pull=E2=80=9D), > setting the variable. > > When binary substitutes are involved some more steps are required: find > and download the public key of the distributor (who might be running > hydra or something like =E2=80=9Cguix publish=E2=80=9D) and authorise it. > > Taken together it may seem a little too cumbersome compared to what > other package managers do. To enable a third-party repository for > Ubuntu, for example, I only need to run one command. When downloading > packages I may also need to verify and accept a GPG key. That=E2=80=99s a two-step process (or one-step if there are no binaries). Honestly, I don=E2=80=99t find it intimidating (definitely not a showstoppe= r), but I agree it=E2=80=99s even better if it can be simplified. > Could it be enough if Guix offered a simpler way to fetch package > definitions and (optionally) binary substitutes from a third party who > maintains both the package definitions and (optionally) distributes > pre-built binary substitutes? > > Here are some concrete proposals: > > * Add a =E2=80=9Cguix config=E2=80=9D command, which allows users to modi= fy the > behaviour of their instance of Guix. > > * Support adding repositories via =E2=80=9Cguix config=E2=80=9D. A =E2= =80=9Crepository=E2=80=9D is a > remote set of Guile modules and (optionally) an public endpoint of > =E2=80=9Cguix publish=E2=80=9D through which substitutes of only those = packages that > are defined in the repository=E2=80=99s modules can be downloaded. > > * The first time a repository is accessed, the specified modules are > cloned and stored in a per-user state directory > (=E2=80=9C~/.cache/guix/=E2=80=9D maybe?). Guix is automatical= ly configured > to use the modules from =E2=80=9C~/.cache/guix/=E2=80=9D in add= ition to what > is on GUIX_PACKAGE_PATH. Additionally, the distribution public key > for binary substitutes is fetched from a well-known location (if > applicable) and users are asked to confirm. > > * When a user runs =E2=80=9Cguix pull=E2=80=9D all enabled repositories a= re also > updated. Otherwise the cached copy from last access is used. > > * Update =E2=80=9Cguix --version=E2=80=9D to also return the version of e= ach configured > repository. > > * Add a command line switch =E2=80=9C--vanilla=E2=80=9D (or similar) to d= isable any > custom configuration and any configured repositories. I like the idea! (With the caveat that, again, external repos can break anytime.) Partly related to that: . Ludo=E2=80=99.