[bug#64861] [PATCH] guix: Add lint check for guix as propagated-input

[bug#64861] [PATCH] guix: Add lint check for guix as propagated-input

[Karl Hallsby via Guix-patches via]

* guix/lint.scm (new check): Run lint check warning user if the provided
package uses guix as a propagated-input.

Passing guix as a propagated-input is problematic when users install a package
into their profiles. This can cause the guix propagated by the package to be
used in preference of the real one in $HOME/.config/. It was first noticed on
IRC with https://logs.guix.gnu.org/guix/2023-07-22.log#044534, and reproduced
with a different package https://logs.guix.gnu.org/guix/2023-07-25.log#054737.
---
 guix/lint.scm | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/guix/lint.scm b/guix/lint.scm
index d173563e51..5fae34ca22 100644
--- a/guix/lint.scm
+++ b/guix/lint.scm
@@ -575,6 +575,16 @@ (define (check-input-labels package)
                 (inputs ,package-inputs)
                 (propagated-inputs ,package-propagated-inputs))))
 
+(define (check-guix-propagated-inputs package)
+  (if (and (not (null? (package-propagated-inputs package)))
+           (not (memq (@ (gnu packages package-management) guix)
+                      (package-propagated-inputs package))))
+      (list
+       (make-warning package
+                     (G_ "are you sure guix should be a propagated-input?")
+                     #:field 'propagated-inputs))
+      '()))
+
 (define (report-wrap-program-error package wrapper-name)
   "Warn that \"bash-minimal\" is missing from 'inputs', while WRAPPER-NAME
 requires it."
@@ -1884,6 +1894,10 @@ (define %local-checkers
      (name        'input-labels)
      (description "Identify input labels that do not match package names")
      (check       check-input-labels))
+   (lint-checker
+     (name        'warn-guix-propagated-inputs)
+     (description "Emit warning if guix package is propagated-input")
+     (check       check-guix-propagated-inputs))
    (lint-checker
      (name        'wrapper-inputs)
      (description "Make sure 'wrap-program' can finds its interpreter.")

base-commit: 9ff1e7652a407b88a3eeeab6a67261f6fee40807
-- 
2.40.1

[bug#64861] [PATCH] guix: Add lint check for guix as propagated-input

[Christopher Baines]

[-- Attachment #1: Type: text/plain, Size: 2052 bytes --]


Karl Hallsby <karl@hallsby.com> writes:

> * guix/lint.scm (new check): Run lint check warning user if the provided
> package uses guix as a propagated-input.
>
> Passing guix as a propagated-input is problematic when users install a package
> into their profiles. This can cause the guix propagated by the package to be
> used in preference of the real one in $HOME/.config/. It was first noticed on
> IRC with https://logs.guix.gnu.org/guix/2023-07-22.log#044534, and reproduced
> with a different package https://logs.guix.gnu.org/guix/2023-07-25.log#054737.
> ---
>  guix/lint.scm | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)

I'm not sure this lint warning is helpful as in both cases mentioned in
the IRC links you provided (guile-imanifest and guix-data-service),
these packages provide Guile modules that depend on Guix, and therefore
the guix package is expected in their propagated inputs.

If you remove guix or make it a input instead of a propagated input,
then this breaks using the package, for example, with this change:

  modified   gnu/packages/guile-xyz.scm
  @@ -2098,8 +2098,10 @@ (define-public guile-imanifest
         (build-system guile-build-system)
         (native-inputs
          (list guile-3.0))
  +      (inputs
  +       (list guix))
         (propagated-inputs
  -       (list guile-readline guile-colorized guix))
  +       (list guile-readline guile-colorized))
         (home-page "https://sr.ht/~brown121407/guile-imanifest")
         (synopsis "Interactive Guix manifests")
         (description "This package provides functions to generate Guix manifests

Using guile-imanifest breaks:

  → ./pre-inst-env guix environment --pure --ad-hoc guile guile-imanifest -- guile -c "(use-modules (imanifest))"
  Backtrace:
    ...

  ice-9/boot-9.scm:3330:6: In procedure resolve-interface:
  no code for module (guix profiles)


I think some other approach is needed to avoid people having problems
with the guix package appearing in their users profile.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 987 bytes --]

[bug#64861] [PATCH] guix: Add lint check for guix as propagated-input

[Karl G. Hallsby via Guix-patches via]

Christopher Baines <mail@cbaines.net> writes:

> [[PGP Signed Part:Undecided]]
>
> Karl Hallsby <karl@hallsby.com> writes:
>
>> * guix/lint.scm (new check): Run lint check warning user if the provided
>> package uses guix as a propagated-input.
>>
>> Passing guix as a propagated-input is problematic when users install a package
>> into their profiles. This can cause the guix propagated by the package to be
>> used in preference of the real one in $HOME/.config/. It was first noticed on
>> IRC with https://logs.guix.gnu.org/guix/2023-07-22.log#044534, and reproduced
>> with a different package https://logs.guix.gnu.org/guix/2023-07-25.log#054737.
>> ---
>>  guix/lint.scm | 14 ++++++++++++++
>>  1 file changed, 14 insertions(+)
>
> I'm not sure this lint warning is helpful as in both cases mentioned in
> the IRC links you provided (guile-imanifest and guix-data-service),
> these packages provide Guile modules that depend on Guix, and therefore
> the guix package is expected in their propagated inputs.
>
> If you remove guix or make it a input instead of a propagated input,
> then this breaks using the package, for example, with this change:
>
>   modified   gnu/packages/guile-xyz.scm
>   @@ -2098,8 +2098,10 @@ (define-public guile-imanifest
>          (build-system guile-build-system)
>          (native-inputs
>           (list guile-3.0))
>   +      (inputs
>   +       (list guix))
>          (propagated-inputs
>   -       (list guile-readline guile-colorized guix))
>   +       (list guile-readline guile-colorized))
>          (home-page "https://sr.ht/~brown121407/guile-imanifest")
>          (synopsis "Interactive Guix manifests")
>          (description "This package provides functions to generate Guix manifests
>
> Using guile-imanifest breaks:
>
>   → ./pre-inst-env guix environment --pure --ad-hoc guile guile-imanifest -- guile -c "(use-modules (imanifest))"
>   Backtrace:
>     ...
>
>   ice-9/boot-9.scm:3330:6: In procedure resolve-interface:
>   no code for module (guix profiles)
>
>
> I think some other approach is needed to avoid people having problems
> with the guix package appearing in their users profile.
>
> [[End of PGP Signed Part]]

That makes sense. Though, this lint is just a warning, so if nothing
else, it should make people think if guix really needs to be propagated.
If this lint is not the solution, then a way to mark packages that are
not recommended to be installed like this would be nice.

[bug#64861] [PATCH] guix: Add lint check for guix as propagated-input

[Ludovic Courtès]

Hi,

Christopher Baines <mail@cbaines.net> skribis:

> Using guile-imanifest breaks:
>
>   → ./pre-inst-env guix environment --pure --ad-hoc guile guile-imanifest -- guile -c "(use-modules (imanifest))"
>   Backtrace:
>     ...
>
>   ice-9/boot-9.scm:3330:6: In procedure resolve-interface:
>   no code for module (guix profiles)

Maybe ‘guile-imanifest’ should be made a Guix extension, which Guix
searches for in $GUIX_EXTENSIONS_PATH?

An example of that is ‘guix-modules’.

Ludo’.

[bug#64861] [PATCH] guix: Add lint check for guix as propagated-input

[Simon Tournier]

Hi,

On Sun, 20 Aug 2023 at 22:58, Ludovic Courtès <ludo@gnu.org> wrote:

> Maybe ‘guile-imanifest’ should be made a Guix extension, which Guix
> searches for in $GUIX_EXTENSIONS_PATH?

And probably renamed ’guix-imanifest’?

Back to the submission, I think that the propagation of the package guix
means something is wrong.  From my point of view, there is two cases:

 1. The package uses the stable library API and thus it makes sense to
    rely on the package ’guix’.  That’s the case for ’gwl’,
    ’guix-data-service’ for example.

 2. The aim of package is to collaborate with the current Guix and thus
    there is no point to have the package ’guix’ as inputs.  Instead,
    the package must rely on GUIX_EXTENSIONS_PATH.  That’s the case for
    ’guix-modules’ or ’guile-imanifest’ (so that needs a fix ;-))

Therefore, I think this new checker makes sense.  WDYT?


About #1, IMHO, this is expected:

--8<---------------cut here---------------start------------->8---
$ guix shell -C gwl -- guix --version
guix shell: error: guix: command not found

        (define-public gwl
            (inputs
        [...]
               (list guix
--8<---------------cut here---------------end--------------->8---

and this is not expected:

--8<---------------cut here---------------start------------->8---
$ guix shell -C guix-data-service -- guix --version
guix (GNU Guix) 1.4.0-10.4dfdd82
Copyright (C) 2023 the Guix authors
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

        (define-public guix-data-service
        [...]
              (propagated-inputs
               (list guix
--8<---------------cut here---------------end--------------->8---


Cheers,
simon