Re: ‘guix publish’ now compresses archives

[Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>]

Tomáš Čech <sleep_walker@gnu.org> writes:

> Imagine situation where person A is running some distribution with
> Guix package manager on top and has some set of his personal packages
> containing additional patches which are not part of Guix GIT.
>
> He'd like to share the package with person B, running different
> distribution with Guix package manager at different revision on top,
> with different set of personal packages and alterations.
>
> I'd like to provide them a way, how to pass from person A to person B
> some binary archive in a way that he could understand (and verify)
> what he received. If it requries out-of-tree package definitions of
> person A, patches, etc, bundle it together.

This is already possible with “guix archive --export” and “--import”.

For the users at the MDC I wrote a little guide on how to share software
environments with other people so that others can reproduce the exact
same state.  The first way to share an environment is symbolic,
i.e. a manifest + Guix git hash + git hashes of any additional package
repositories.

The second way to share an environment is the binary method.  With this
command you can export a complete profile (e.g. at
“/project/.guix-profile”) and write it to a gzipped archive:

#+BEGIN_SRC
guix archive --export --recursive \
  $(readlink -f /project/.guix-profile) | \
  gzip --stdout - > my-profile.nar.gz
#+END_SRC

The recipient can take this archive and import it into their store after
authenticating the public key of the sender.  The result of importing is
that a bunch of store items appear in the receiver’s Guix store.

Note that the package artifacts in the exported profile don’t have to be
the result of building packages from the package expressions in upstream
Guix.  They can include packages that were only defined in some
directory of GUIX_PACKAGE_PATH or that have been imported from another
store.

What’s not so nice about this is that you can end up with binaries in
your store that you cannot rebuild yourself (because you never had the
sources to begin with).  (I wonder if this has implications on software
freedom.)

~~ Ricardo