Re: persistent reproducibility ?

[Chris Marusich <cmmarusich@gmail.com>]

zimoun <zimon.toutoune@gmail.com> writes:

> Maybe `archive' or `pack' already do the job ? Something able to pack
> at the source level all the necessary materials to reproduce from
> scratch a bit-identical environment.

What about using 'guix archive' in combination with the 'guix build
--sources=transitive' command?  The manual explains ((guix) Additional
Build Options), the "--sources=transitive" option means:

"Build the source derivations of all packages, as well of all transitive
inputs to the packages.  This can be used e.g.  to prefetch package
source for later offline building."

Here's an example for the GNU Hello package:

--8<---------------cut here---------------start------------->8---
$ guix build --sources=transitive hello
/gnu/store/hbdalsf5lpf01x4dcknwx6xbn6n5km6k-hello-2.10.tar.gz
/gnu/store/cz1b1hn763zppafmlxsrlj7fnxa8zcna-tar-1.29.tar.xz
/gnu/store/f63c6mjqqai6xwypx5qslvqc2d302yn5-gzip-1.8.tar.xz
/gnu/store/bjpalrv9f49d2k40p7ga0y6dwdys9w5j-bzip2-1.0.6.tar.gz
/gnu/store/1pcksb758j9v7srain0k3fqp57h9gwmj-xz-5.2.2.tar.gz
/gnu/store/r56rrdk6h0zwb1d2y28q3bk71n73z84m-file-5.28.tar.gz
/gnu/store/rbaa5s5jpy91npas89q3p8yasrc6mr1h-diffutils-3.5.tar.xz
/gnu/store/iaigwb3k7fg0v8zrwlb4yhrdsgin6ir7-patch-2.7.5.tar.xz
/gnu/store/g0mffc9c0nxbwf0a6j0akh0dvkd2sn6w-sed-4.2.2.tar.xz
/gnu/store/76q5cqkqrx7paxhq27m3izag07n1vjs4-findutils-4.6.0.tar.xz
/gnu/store/vgs8flhpxbkgx0hx54hnihpai7lma72j-gawk-4.1.4.tar.xz
/gnu/store/5q4yicgzxrv13gq4rai6h07s7xp75ws6-grep-2.25.tar.xz
/gnu/store/8dqf59312llnmln89ccas1saq0z4qwi7-coreutils-8.25.tar.xz
/gnu/store/2g7nf5h6hnsz1sharnqxfjz9m6k7224z-make-4.2.1.tar.xz
/gnu/store/xwanyg9972rpznx89ja38v01c8483392-bash-4.4.tar.gz
/gnu/store/iv2nz8r001lpric4kr2xq3459zwl8051-binutils-2.27.tar.xz
/gnu/store/z2s847iq14psryslylm1x4k71b0vx4ng-gcc-4.9.4.tar.xz
/gnu/store/m9jym12mhczjrslpycwi6ipw57v849pa-gmp-6.0.0a.tar.xz
/gnu/store/xg7ir7g2yvxj9ixmgy2kfds690h3f6gg-mpfr-3.1.4.tar.xz
/gnu/store/y9akh452n3p4w2v631nj0injx7y0d68x-mpc-1.0.3.tar.gz
/gnu/store/z8mm3izh1hgllm6mlqzycsrx5nfkvhxi-glibc-2.24.tar.xz
/gnu/store/51f2f2ck80migsfr2hwy4ds30966lifi-linux-libre-4.4.18-gnu.tar.xz
--8<---------------cut here---------------end--------------->8---

You could archive those sources for later importation into the store on
another system.  For example:

  guix archive --export \
    $(guix build --sources=transitive hello) > hello-transitive-source.nar

If you import that archive (with 'guix archive --import') and build it
using the same version of the package definitions, theoretically it
should build even if the sources are no longer available for download
from their specified origin locations.

You could even do more.  By using 'guix gc', you could also include all
of the store items which are required to run GNU Hello:

--8<---------------cut here---------------start------------->8---
$ guix gc --requisites $(guix build hello)
/gnu/store/rvgmixpmsq5lqr9qflhkm70kg7a4rys2-bash-static-4.4.0
/gnu/store/iwgi9001dmmihrjg4rqhd6pa6788prjw-glibc-2.24
/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib
/gnu/store/rvs42awwwby7pq3j0znglmz3vyznvbh1-hello-2.10
--8<---------------cut here---------------end--------------->8---

Combine those two commands, and you should be able to export an archive
which contains all the files necessary to run GNU Hello, in addition to
all the sources necessary to build GNU Hello reproducibly (provided that
GNU Hello builds reproducibly, and provided that you build it using the
same version of the package definitions):

  guix archive --export \
    $(guix gc --requisites $(guix build hello)) \
    $(guix build --sources=transitive hello) > hello-requisites-and-sources.nar

You would also have to trust the key that was used to sign the archive
in order to import it (see 'guix archive --authorize').

By the way, in case you were wondering, one reason why we don't put the
sources for every package into the Guix source tree is because that
would make the Guix source tree prohibitively large.  The transitive
closure of sources for GNU Hello alone weighs in at 1750 MiB (wow!) when
uncompressed.  And that's only for those specific versions of the source
files.

-- 
Chris