The way to promote GUIX package manager

The way to promote GUIX package manager

[Sławomir Lach]

Maybe it's road to security hell, but it is also very important for beginners 
and developers.

Promote GNU GUIX by add support for installers/some scripts, which detects OS 
and install software by package manager based on detection.
It is very hard to keep this kind of scripts fresh, because distribution will 
evolve. One think, that developers should still do is keep instructions to 
install guix package manager for some distros, but it is easier than keep 
instruction to install ton of packages. Maybe creating script to install guix 
for distributions and place it on single place + allow distro vendor to change 
it? Solution is simple:
1. Keep older packages in GUIX repo, so developers could request older version 
in scripts
2. Send patches to developers of these scripts, which will detects if there is 
gnu guix package manager on target system installed and request to install 
packages in exact versions, if there was gnu guix installed

USE CASES:
1. KDevelop could request to install developers tools, such like gcc, gdb, 
php, etc.
2. Gaming managers could base on gnu guix instead of custom repository
3. ETC.

RESULT:
Simpler script to maintain, more distribution addressed, user do not have to 
worry if script will work for one's distro, faster advantage in linux 
ecosystem. Minus: possible security hell.

Re: The way to promote GUIX package manager

[Ricardo Wurmus]

Sławomir Lach <slawek@lach.art.pl> writes:

> Solution is simple:
> 1. Keep older packages in GUIX repo, so developers could request older version 
> in scripts

Unforunately, it’s really not that simply to keep older packages around.
I’m maintaining packages for a bunch of bioinformatics tools, for
example, which are stuck in the past.  Building them becomes more and
more difficult as time passes and the rest of the world moves on.  It is
not feasible to maintain an ever-growing collection of outdated software
and their toolchains.

But: Guix supports channels, so people who absolutely must use GCC 3 to
build their abandoned tools to build their old source code that’s stuck
in the past can totally do that.

> Minus: possible security hell.

:)

-- 
Ricardo

Re: The way to promote GUIX package manager

[Yasuaki Kudo]

Does Guix really run out of the box in Debian?

I have never tried it but my friend Debian expert friend keeps telling me that:

* Just apt-get installing Guix doesn't work

* and his really big complaint is evidently he creates "virtual environments" (short of full-on VMware, I imagine it is an assortment of Linux native tricks that are wrapped by tools like Docker) for every OS he tries but 
* Evidently the same tricks don't work with Guix

* He does not want to try full blown Guix OS without first testing it in above ways

* He is very comfortable with Debian - doesn't see any benefit that Guix brings

I cannot comment much because the whole point of my using Guix is precisely because I know very little if Linux and its surrounding toolset so I want to abstract it, paper it over with Guix 😄

-Yasu


> On Jan 27, 2022, at 06:43, Ricardo Wurmus <rekado@elephly.net> wrote:
> 
> 
> Sławomir Lach <slawek@lach.art.pl> writes:
> 
>> Solution is simple:
>> 1. Keep older packages in GUIX repo, so developers could request older version 
>> in scripts
> 
> Unforunately, it’s really not that simply to keep older packages around.
> I’m maintaining packages for a bunch of bioinformatics tools, for
> example, which are stuck in the past.  Building them becomes more and
> more difficult as time passes and the rest of the world moves on.  It is
> not feasible to maintain an ever-growing collection of outdated software
> and their toolchains.
> 
> But: Guix supports channels, so people who absolutely must use GCC 3 to
> build their abandoned tools to build their old source code that’s stuck
> in the past can totally do that.
> 
>> Minus: possible security hell.
> 
> :)
> 
> -- 
> Ricardo
> 

Re: The way to promote GUIX package manager

[Ricardo Wurmus]

Yasuaki Kudo <yasu@yasuaki.com> writes:

> Does Guix really run out of the box in Debian?
>
> I have never tried it but my friend Debian expert friend keeps telling me that:
>
> * Just apt-get installing Guix doesn't work

How does “apt install guix” not work?  There’s an older version of Guix
in Debian.  After installing it “guix pull” should get the latest
version and it all works.

There’s also an installer script at https://guix.gnu.org/install.sh
which skips the detour through apt and gets you the latest release
directly.

> * and his really big complaint is evidently he creates "virtual
> environments" (short of full-on VMware, I imagine it is an assortment
> of Linux native tricks that are wrapped by tools like Docker) for
> every OS he tries but
> * Evidently the same tricks don't work with Guix

Is this not *exactly* what “guix shell” (formerly “guix enviromnent”)
does?  “guix shell -C” enters a container, even, using the same Linux
namespace mechanism that Docker wraps.

> * He does not want to try full blown Guix OS without first testing it in above ways

Guix can comfortably be used outside of Guix System.  And you can
*still* use most “guix system” commands, e.g. to build containers or
virtual machines.

-- 
Ricardo

Re: The way to promote GUIX package manager

[Yasuaki Kudo]

Well I have to tell you I am not too familiar with either Debian or Guix😅  So with that disclaimer:

- If I remember correctly, Guix in Debian just doesn't work straight away after apt-get install, meaning enabling of certain Guix services also required?

- He needs to have everything that Guix needs "virtualized", including the folder /gnu straight under root, (under some /home/xyzuser/blah/ directory I presume).   He does not care about Guix-as-container - he needs Guix-to-be-contained.

Again, I don't know much, Im' just a casual Guix OS user (and I love it 😄) but does it make sense?

-Yasu


> On Jan 27, 2022, at 07:46, Ricardo Wurmus <rekado@elephly.net> wrote:
> 
> 
> Yasuaki Kudo <yasu@yasuaki.com> writes:
> 
>> Does Guix really run out of the box in Debian?
>> 
>> I have never tried it but my friend Debian expert friend keeps telling me that:
>> 
>> * Just apt-get installing Guix doesn't work
> 
> How does “apt install guix” not work?  There’s an older version of Guix
> in Debian.  After installing it “guix pull” should get the latest
> version and it all works.
> 
> There’s also an installer script at https://guix.gnu.org/install.sh
> which skips the detour through apt and gets you the latest release
> directly.
> 
>> * and his really big complaint is evidently he creates "virtual
>> environments" (short of full-on VMware, I imagine it is an assortment
>> of Linux native tricks that are wrapped by tools like Docker) for
>> every OS he tries but
>> * Evidently the same tricks don't work with Guix
> 
> Is this not *exactly* what “guix shell” (formerly “guix enviromnent”)
> does?  “guix shell -C” enters a container, even, using the same Linux
> namespace mechanism that Docker wraps.
> 
>> * He does not want to try full blown Guix OS without first testing it in above ways
> 
> Guix can comfortably be used outside of Guix System.  And you can
> *still* use most “guix system” commands, e.g. to build containers or
> virtual machines.
> 
> -- 
> Ricardo

Re: The way to promote GUIX package manager

[Vagrant Cascadian]

[-- Attachment #1: Type: text/plain, Size: 985 bytes --]

On 2022-01-27, Yasuaki Kudo wrote:
> Does Guix really run out of the box in Debian?
>
> I have never tried it but my friend Debian expert friend keeps telling me that:
>
> * Just apt-get installing Guix doesn't work

What doesn't work?

The main two issues I'm aware of are...

Issue with "guix pull" from the guix 1.2 version:

  https://bugs.debian.org/1001833

The workaround is to first pull to the guix 1.3 commit.


The other issue has to do with incompatible glib versions in guix and
Debian:

  https://bugs.debian.org/988260

I'm not aware of a workaround there other than sticking with either Guix
or Debian for the affected packages.


So I'll admit the experience is not absolutely free of surprises, but
that's the generally the case of using any foreign package manager...


If there are other issues specific to the Guix packages in Debian,
please file bugs in the Debian bug tracking system; it's a great way to
contribute back to the community!


live well,
  vagrant

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: The way to promote GUIX package manager

[Bengt Richter]

On +2022-01-26 23:42:05 +0100, Ricardo Wurmus wrote:
> 
> Yasuaki Kudo <yasu@yasuaki.com> writes:
> 
> > Does Guix really run out of the box in Debian?
> >
> > I have never tried it but my friend Debian expert friend keeps telling me that:
> >
> > * Just apt-get installing Guix doesn't work
> 
> How does “apt install guix” not work?  There’s an older version of Guix
> in Debian.  After installing it “guix pull” should get the latest
> version and it all works.
>

What does "apt search guix" produce?
(Nothing, on the puri.sm variant of debian. They maintain a custom
pool based on debian minus what they want to exclude AIUI)

> There’s also an installer script at https://guix.gnu.org/install.sh
> which skips the detour through apt and gets you the latest release
> directly.
> 
> > * and his really big complaint is evidently he creates "virtual
> > environments" (short of full-on VMware, I imagine it is an assortment
> > of Linux native tricks that are wrapped by tools like Docker) for
> > every OS he tries but
> > * Evidently the same tricks don't work with Guix
> 
> Is this not *exactly* what “guix shell” (formerly “guix enviromnent”)
> does?  “guix shell -C” enters a container, even, using the same Linux
> namespace mechanism that Docker wraps.
> 
> > * He does not want to try full blown Guix OS without first testing it in above ways
> 
> Guix can comfortably be used outside of Guix System.  And you can
> *still* use most “guix system” commands, e.g. to build containers or
> virtual machines.
> 
> -- 
> Ricardo
> 

-- 
Regards,
Bengt Richter

Re: The way to promote GUIX package manager

[Yasuaki Kudo]

This is a comment from a very different angle - another way to promote Guix is in the emerging (so I would like to believe 😅) worker cooperatives sector - there is a call for democratically directed software development (not in the do-o-cracy way that happens due to information asymmetry between "producers" and "consumers")

GNU Guix can offer maximum transparency and user friendliness 😄

-Yasu


> On Jan 28, 2022, at 08:36, Bengt Richter <bokr@bokr.com> wrote:
> 
> On +2022-01-26 23:42:05 +0100, Ricardo Wurmus wrote:
>> 
>> Yasuaki Kudo <yasu@yasuaki.com> writes:
>> 
>>> Does Guix really run out of the box in Debian?
>>> 
>>> I have never tried it but my friend Debian expert friend keeps telling me that:
>>> 
>>> * Just apt-get installing Guix doesn't work
>> 
>> How does “apt install guix” not work?  There’s an older version of Guix
>> in Debian.  After installing it “guix pull” should get the latest
>> version and it all works.
>> 
> 
> What does "apt search guix" produce?
> (Nothing, on the puri.sm variant of debian. They maintain a custom
> pool based on debian minus what they want to exclude AIUI)
> 
>> There’s also an installer script at https://guix.gnu.org/install.sh
>> which skips the detour through apt and gets you the latest release
>> directly.
>> 
>>> * and his really big complaint is evidently he creates "virtual
>>> environments" (short of full-on VMware, I imagine it is an assortment
>>> of Linux native tricks that are wrapped by tools like Docker) for
>>> every OS he tries but
>>> * Evidently the same tricks don't work with Guix
>> 
>> Is this not *exactly* what “guix shell” (formerly “guix enviromnent”)
>> does?  “guix shell -C” enters a container, even, using the same Linux
>> namespace mechanism that Docker wraps.
>> 
>>> * He does not want to try full blown Guix OS without first testing it in above ways
>> 
>> Guix can comfortably be used outside of Guix System.  And you can
>> *still* use most “guix system” commands, e.g. to build containers or
>> virtual machines.
>> 
>> -- 
>> Ricardo
>> 
> 
> -- 
> Regards,
> Bengt Richter

Re: The way to promote GUIX package manager

[David Pirotte]

[-- Attachment #1: Type: text/plain, Size: 280 bytes --]


> ...
> What does "apt search guix" produce?
> (Nothing, on the puri.sm variant of debian. They maintain a custom
> pool based on debian minus what they want to exclude AIUI)

fwiw,

	https://packages.debian.org/search?keywords=guix&searchon=names&suite=all&section=all

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: The way to promote GUIX package manager

[Bengt Richter]

On +2022-01-27 22:43:06 -0300, David Pirotte wrote:
> 
> > ...
> > What does "apt search guix" produce?
> > (Nothing, on the puri.sm variant of debian. They maintain a custom
> > pool based on debian minus what they want to exclude AIUI)
> 
> fwiw,
> 
>       https://packages.debian.org/search?keywords=guix&searchon=names&suite=all&section=all

Yeah, forgot to mention: they don't _prevent_ you from doing anything
you want -- in fact that's what they're about: to ensure that you
(having the necesssary expertise or funds to hire it) _can_
control as near as possible everything your computer does, including
(not quite all) IME firmware, bios, bootloaders and the whole chain onwards.

OTOH they may not want to spend a lot of time helping you undo
what you did to yourself by bypassing their packages and safeguards.

They may instead suggest you install QubesOS and run iffy stuff
(like guix, whose reproducibility unfortunately does not exclude
reproducing bugs and vulnerabilities :) in a dom for untrusted sfw.

Personally, I like simplicity best, so I am watching MES and RISC-V
and hoping for a "stateless" laptop which will bootload _anything_ into
memory from _anywhere_ -- and ask me (via trustable interface)
if I like the sha256 it computed for the image just loaded.
Bonus for asking me if I want it to check or add to white-list
via secure protocol to USB goodie.

With only hot-pluggable high speed disks, I can just with  keep my precious
stuff fully separate and unconnected while I take internet advice like
"just run everything as root, it makes it so much easier for a newbie." ;-)

I think SeaBIOS and a doctored kernel-independent grub can get close,
but I want stateless with _all_ hot-pluggable hard disks,
even if two (for raid or cloning) of them have convenience slots
to hold them as cartridges.

Dreaming on ...
-- 
Regards,
Bengt Richter

Re: The way to promote GUIX package manager

[Ludovic Courtès]

Hi!

Vagrant Cascadian <vagrant@debian.org> skribis:

> The main two issues I'm aware of are...
>
> Issue with "guix pull" from the guix 1.2 version:
>
>   https://bugs.debian.org/1001833

I believe this was fixed:

  https://issues.guix.gnu.org/52694

Thanks,
Ludo’.

Re: The way to promote GUIX package manager

[Ricardo Wurmus]

Ludovic Courtès <ludo@gnu.org> writes:

> Hi!
>
> Vagrant Cascadian <vagrant@debian.org> skribis:
>
>> The main two issues I'm aware of are...
>>
>> Issue with "guix pull" from the guix 1.2 version:
>>
>>   https://bugs.debian.org/1001833
>
> I believe this was fixed:
>
>   https://issues.guix.gnu.org/52694

Last week (or maybe two weeks ago, but no sooner than that) I ran “sudo
apt install guix” on a laptop with Debian and I followed the advice to
pull to the commit corresponding to 1.3.0.

Every time at the end I got this git error: “the requested type does not
match the type in the ODB”.

Would it have been any different had I pulled directly to the latest
version…?  Or is this unrelated?

(In the end I removed the Debian package and installed with
https://guix.gnu.org/install.sh; this was trickier than it should have
been, because the Debian package left behind a broken init service and
some state that I deleted manually.)

-- 
Ricardo

Re: The way to promote GUIX package manager

[Vagrant Cascadian]

[-- Attachment #1: Type: text/plain, Size: 1497 bytes --]

On 2022-02-05, Ricardo Wurmus wrote:
> Ludovic Courtès <ludo@gnu.org> writes:
>> Vagrant Cascadian <vagrant@debian.org> skribis:
>>
>>> The main two issues I'm aware of are...
>>>
>>> Issue with "guix pull" from the guix 1.2 version:
>>>
>>>   https://bugs.debian.org/1001833
>>
>> I believe this was fixed:
>>
>>   https://issues.guix.gnu.org/52694

Great, will try it again!


> Last week (or maybe two weeks ago, but no sooner than that) I ran “sudo
> apt install guix” on a laptop with Debian and I followed the advice to
> pull to the commit corresponding to 1.3.0.

That definitely worked a while back when I followed up to the Debian
bug, but guix always seems to have some new surprises in store!


> Every time at the end I got this git error: “the requested type does not
> match the type in the ODB”.
>
> Would it have been any different had I pulled directly to the latest
> version…?  Or is this unrelated?

I'll have to verify again...


> (In the end I removed the Debian package and installed with
> https://guix.gnu.org/install.sh; this was trickier than it should have
> been, because the Debian package left behind a broken init service and
> some state that I deleted manually.)

There is a difference on Debian between removed and purged, sounds like
you just removed it:

  apt --purge remove PACKAGE

should have done what you wanted, and if it didn't, bugs reports would
be appreciated...


live well,
  vagrant

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: The way to promote GUIX package manager

[Ricardo Wurmus]

Vagrant Cascadian <vagrant@debian.org> writes:

>> (In the end I removed the Debian package and installed with
>> https://guix.gnu.org/install.sh; this was trickier than it should have
>> been, because the Debian package left behind a broken init service and
>> some state that I deleted manually.)
>
> There is a difference on Debian between removed and purged, sounds like
> you just removed it:
>
>   apt --purge remove PACKAGE
>
> should have done what you wanted, and if it didn't, bugs reports would
> be appreciated...

Ah, I wasn’t aware of the difference.  I’m sure it works fine.  Now I no
longer have a way to test this, though, as the laptop uses Guix now.

-- 
Ricardo

Re: The way to promote GUIX package manager

[Ludovic Courtès]

Hallo!

Ricardo Wurmus <rekado@elephly.net> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Hi!
>>
>> Vagrant Cascadian <vagrant@debian.org> skribis:
>>
>>> The main two issues I'm aware of are...
>>>
>>> Issue with "guix pull" from the guix 1.2 version:
>>>
>>>   https://bugs.debian.org/1001833
>>
>> I believe this was fixed:
>>
>>   https://issues.guix.gnu.org/52694
>
> Last week (or maybe two weeks ago, but no sooner than that) I ran “sudo
> apt install guix” on a laptop with Debian and I followed the advice to
> pull to the commit corresponding to 1.3.0.

It should no longer be needed.

> Every time at the end I got this git error: “the requested type does not
> match the type in the ODB”.

I think this bug was present in 1.3.0 and was since fixed:

  commit efa578ecaece67366b4b0e2266de7c2faaa4ae54
  https://issues.guix.gnu.org/40377

No workaround for this one, other than passing the actual commit ID
instead of the tag name to ‘guix pull --commit’.

Ludo’.