unofficial mirror of help-guix@gnu.org 
 help / color / mirror / Atom feed
* guix hash of source from git repository.
@ 2017-02-21 21:19 Dmitry Nikolaev
  2017-02-21 21:25 ` Catonano
  2017-02-21 22:17 ` Leo Famulari
  0 siblings, 2 replies; 7+ messages in thread
From: Dmitry Nikolaev @ 2017-02-21 21:19 UTC (permalink / raw)
  To: help-guix

[-- Attachment #1: Type: text/plain, Size: 809 bytes --]

When writing package definition, what if I download sources from git
repository? For example:

(define-public libwebsockets
  (package
    (name "libwebsockets")
    (version "1.3")
    (source (origin
              ;; The project does not publish tarballs, so we have to take
              ;; things from Git.
              (method git-fetch)
              (uri (git-reference
                    (url "git://git.libwebsockets.org/libwebsockets")
                    (commit (string-append "v" version
                                           "-chrome37-firefox30"))))
              (sha256
               (base32
                "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
              (file-name (string-append name "-" version))))
...

How do I calculate this 12fqh2d...?

Dmitry Nikolaev

[-- Attachment #2: Type: text/html, Size: 1269 bytes --]

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: guix hash of source from git repository.
  2017-02-21 21:19 guix hash of source from git repository Dmitry Nikolaev
@ 2017-02-21 21:25 ` Catonano
  2017-02-21 21:56   ` ng0
  2017-03-06 10:55   ` Ludovic Courtès
  2017-02-21 22:17 ` Leo Famulari
  1 sibling, 2 replies; 7+ messages in thread
From: Catonano @ 2017-02-21 21:25 UTC (permalink / raw)
  To: Dmitry Nikolaev; +Cc: help-guix

[-- Attachment #1: Type: text/plain, Size: 1359 bytes --]

Hi Dmitry,

2017-02-21 22:19 GMT+01:00 Dmitry Nikolaev <cameltheman@gmail.com>:

> When writing package definition, what if I download sources from git
> repository? For example:
>
> (define-public libwebsockets
>   (package
>     (name "libwebsockets")
>     (version "1.3")
>     (source (origin
>               ;; The project does not publish tarballs, so we have to take
>               ;; things from Git.
>               (method git-fetch)
>               (uri (git-reference
>                     (url "git://git.libwebsockets.org/libwebsockets")
>                     (commit (string-append "v" version
>                                            "-chrome37-firefox30"))))
>               (sha256
>                (base32
>                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
>               (file-name (string-append name "-" version))))
> ...
>
> How do I calculate this 12fqh2d...?
>
> Dmitry Nikolaev
>

You clone the git repository locally, then you use 'guix hash' as explained
in this page of the manual (the option you want to use is "--recursive")

https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html

Another option is to try to build the package with the wrong hash, wait for
the error message and copy the right hash from within the error message
itself. Lame, but hey

Hope this helps !

Ciao

[-- Attachment #2: Type: text/html, Size: 2464 bytes --]

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: guix hash of source from git repository.
  2017-02-21 21:25 ` Catonano
@ 2017-02-21 21:56   ` ng0
  2017-02-21 22:21     ` Leo Famulari
  2017-03-06 10:55   ` Ludovic Courtès
  1 sibling, 1 reply; 7+ messages in thread
From: ng0 @ 2017-02-21 21:56 UTC (permalink / raw)
  To: Catonano; +Cc: Dmitry Nikolaev, help-guix

On 17-02-21 22:25:35, Catonano wrote:
> Hi Dmitry,
> 
> 2017-02-21 22:19 GMT+01:00 Dmitry Nikolaev <cameltheman@gmail.com>:
> 
> > When writing package definition, what if I download sources from git
> > repository? For example:
> >
> > (define-public libwebsockets
> >   (package
> >     (name "libwebsockets")
> >     (version "1.3")
> >     (source (origin
> >               ;; The project does not publish tarballs, so we have to take
> >               ;; things from Git.
> >               (method git-fetch)
> >               (uri (git-reference
> >                     (url "git://git.libwebsockets.org/libwebsockets")
> >                     (commit (string-append "v" version
> >                                            "-chrome37-firefox30"))))
> >               (sha256
> >                (base32
> >                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
> >               (file-name (string-append name "-" version))))
> > ...
> >
> > How do I calculate this 12fqh2d...?
> >
> > Dmitry Nikolaev
> >
> 
> You clone the git repository locally, then you use 'guix hash' as explained
> in this page of the manual (the option you want to use is "--recursive")
> 
> https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html

Please avoid doing the way described below though. Calculating it in
advance is more secure and helps to prevent introducing errors. If
there's a mismatch it shows an error.
 
> Another option is to try to build the package with the wrong hash, wait for
> the error message and copy the right hash from within the error message
> itself. Lame, but hey
> 
> Hope this helps !
> 
> Ciao

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: guix hash of source from git repository.
  2017-02-21 21:19 guix hash of source from git repository Dmitry Nikolaev
  2017-02-21 21:25 ` Catonano
@ 2017-02-21 22:17 ` Leo Famulari
  2017-02-22  8:23   ` Catonano
  1 sibling, 1 reply; 7+ messages in thread
From: Leo Famulari @ 2017-02-21 22:17 UTC (permalink / raw)
  To: Dmitry Nikolaev; +Cc: help-guix

On Wed, Feb 22, 2017 at 12:19:35AM +0300, Dmitry Nikolaev wrote:
> When writing package definition, what if I download sources from git
> repository? For example:
> 
> (define-public libwebsockets
>   (package
>     (name "libwebsockets")
>     (version "1.3")
>     (source (origin
>               ;; The project does not publish tarballs, so we have to take
>               ;; things from Git.
>               (method git-fetch)
>               (uri (git-reference
>                     (url "git://git.libwebsockets.org/libwebsockets")
>                     (commit (string-append "v" version
>                                            "-chrome37-firefox30"))))
>               (sha256
>                (base32
>                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
>               (file-name (string-append name "-" version))))
> ...
> 
> How do I calculate this 12fqh2d...?

Clone the Git repository in the normal way, check out the Git commit you
want to base the Guix package on, and then do this:

$ guix hash --recursive --exclude-vcs path/to/git-repo

This is explained in the manual, section Invoking guix hash:

https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: guix hash of source from git repository.
  2017-02-21 21:56   ` ng0
@ 2017-02-21 22:21     ` Leo Famulari
  0 siblings, 0 replies; 7+ messages in thread
From: Leo Famulari @ 2017-02-21 22:21 UTC (permalink / raw)
  To: Catonano, Dmitry Nikolaev, help-guix

On Tue, Feb 21, 2017 at 09:56:29PM +0000, ng0 wrote:
> On 17-02-21 22:25:35, Catonano wrote:
> Please avoid doing the way described below though. Calculating it in
> advance is more secure and helps to prevent introducing errors. If
> there's a mismatch it shows an error.
>  
> > Another option is to try to build the package with the wrong hash, wait for
> > the error message and copy the right hash from within the error message
> > itself. Lame, but hey

I agree with ng0. We should not do this when creating Guix packages.

The guix download code has a relatively rare "network signature" when
compared to things like a web browser or wget.

Someone could serve a different file when they detect use of the Guix
download tool, and if this makes it into a package definition, all of
our users would end up with the wrong software.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: guix hash of source from git repository.
  2017-02-21 22:17 ` Leo Famulari
@ 2017-02-22  8:23   ` Catonano
  0 siblings, 0 replies; 7+ messages in thread
From: Catonano @ 2017-02-22  8:23 UTC (permalink / raw)
  To: Leo Famulari; +Cc: Dmitry Nikolaev, help-guix

[-- Attachment #1: Type: text/plain, Size: 1469 bytes --]

2017-02-21 23:17 GMT+01:00 Leo Famulari <leo@famulari.name>:

> On Wed, Feb 22, 2017 at 12:19:35AM +0300, Dmitry Nikolaev wrote:
> > When writing package definition, what if I download sources from git
> > repository? For example:
> >
> > (define-public libwebsockets
> >   (package
> >     (name "libwebsockets")
> >     (version "1.3")
> >     (source (origin
> >               ;; The project does not publish tarballs, so we have to
> take
> >               ;; things from Git.
> >               (method git-fetch)
> >               (uri (git-reference
> >                     (url "git://git.libwebsockets.org/libwebsockets")
> >                     (commit (string-append "v" version
> >                                            "-chrome37-firefox30"))))
> >               (sha256
> >                (base32
> >                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
> >               (file-name (string-append name "-" version))))
> > ...
> >
> > How do I calculate this 12fqh2d...?
>
> Clone the Git repository in the normal way, check out the Git commit you
> want to base the Guix package on, and then do this:
>
> $ guix hash --recursive --exclude-vcs path/to/git-repo
>
> This is explained in the manual, section Invoking guix hash:
>
> https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html
>
>

I apologize for the off the mark suggestion

I thought it was just lame, I didn't consider it had even more shortcomings

[-- Attachment #2: Type: text/html, Size: 2489 bytes --]

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: guix hash of source from git repository.
  2017-02-21 21:25 ` Catonano
  2017-02-21 21:56   ` ng0
@ 2017-03-06 10:55   ` Ludovic Courtès
  1 sibling, 0 replies; 7+ messages in thread
From: Ludovic Courtès @ 2017-03-06 10:55 UTC (permalink / raw)
  To: Catonano; +Cc: Dmitry Nikolaev, help-guix

Catonano <catonano@gmail.com> skribis:

> Hi Dmitry,
>
> 2017-02-21 22:19 GMT+01:00 Dmitry Nikolaev <cameltheman@gmail.com>:
>
>> When writing package definition, what if I download sources from git
>> repository? For example:
>>
>> (define-public libwebsockets
>>   (package
>>     (name "libwebsockets")
>>     (version "1.3")
>>     (source (origin
>>               ;; The project does not publish tarballs, so we have to take
>>               ;; things from Git.
>>               (method git-fetch)
>>               (uri (git-reference
>>                     (url "git://git.libwebsockets.org/libwebsockets")
>>                     (commit (string-append "v" version
>>                                            "-chrome37-firefox30"))))
>>               (sha256
>>                (base32
>>                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
>>               (file-name (string-append name "-" version))))
>> ...
>>
>> How do I calculate this 12fqh2d...?
>>
>> Dmitry Nikolaev
>>
>
> You clone the git repository locally, then you use 'guix hash' as explained
> in this page of the manual (the option you want to use is "--recursive")
>
> https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html

Specifically, ‘guix hash -rx .’ on a fresh clone, as shown at the
bottom of this page.

Ludo’.

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2017-03-06 10:55 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-21 21:19 guix hash of source from git repository Dmitry Nikolaev
2017-02-21 21:25 ` Catonano
2017-02-21 21:56   ` ng0
2017-02-21 22:21     ` Leo Famulari
2017-03-06 10:55   ` Ludovic Courtès
2017-02-21 22:17 ` Leo Famulari
2017-02-22  8:23   ` Catonano

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).