guix hash of source from git repository.

guix hash of source from git repository.

[Dmitry Nikolaev]

[-- Attachment #1: Type: text/plain, Size: 809 bytes --]

When writing package definition, what if I download sources from git
repository? For example:

(define-public libwebsockets
  (package
    (name "libwebsockets")
    (version "1.3")
    (source (origin
              ;; The project does not publish tarballs, so we have to take
              ;; things from Git.
              (method git-fetch)
              (uri (git-reference
                    (url "git://git.libwebsockets.org/libwebsockets")
                    (commit (string-append "v" version
                                           "-chrome37-firefox30"))))
              (sha256
               (base32
                "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
              (file-name (string-append name "-" version))))
...

How do I calculate this 12fqh2d...?

Dmitry Nikolaev

[-- Attachment #2: Type: text/html, Size: 1269 bytes --]

Re: guix hash of source from git repository.

[Catonano]

[-- Attachment #1: Type: text/plain, Size: 1359 bytes --]

Hi Dmitry,

2017-02-21 22:19 GMT+01:00 Dmitry Nikolaev <cameltheman@gmail.com>:

> When writing package definition, what if I download sources from git
> repository? For example:
>
> (define-public libwebsockets
>   (package
>     (name "libwebsockets")
>     (version "1.3")
>     (source (origin
>               ;; The project does not publish tarballs, so we have to take
>               ;; things from Git.
>               (method git-fetch)
>               (uri (git-reference
>                     (url "git://git.libwebsockets.org/libwebsockets")
>                     (commit (string-append "v" version
>                                            "-chrome37-firefox30"))))
>               (sha256
>                (base32
>                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
>               (file-name (string-append name "-" version))))
> ...
>
> How do I calculate this 12fqh2d...?
>
> Dmitry Nikolaev
>

You clone the git repository locally, then you use 'guix hash' as explained
in this page of the manual (the option you want to use is "--recursive")

https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html

Another option is to try to build the package with the wrong hash, wait for
the error message and copy the right hash from within the error message
itself. Lame, but hey

Hope this helps !

Ciao

[-- Attachment #2: Type: text/html, Size: 2464 bytes --]

Re: guix hash of source from git repository.

[ng0]

On 17-02-21 22:25:35, Catonano wrote:
> Hi Dmitry,
> 
> 2017-02-21 22:19 GMT+01:00 Dmitry Nikolaev <cameltheman@gmail.com>:
> 
> > When writing package definition, what if I download sources from git
> > repository? For example:
> >
> > (define-public libwebsockets
> >   (package
> >     (name "libwebsockets")
> >     (version "1.3")
> >     (source (origin
> >               ;; The project does not publish tarballs, so we have to take
> >               ;; things from Git.
> >               (method git-fetch)
> >               (uri (git-reference
> >                     (url "git://git.libwebsockets.org/libwebsockets")
> >                     (commit (string-append "v" version
> >                                            "-chrome37-firefox30"))))
> >               (sha256
> >                (base32
> >                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
> >               (file-name (string-append name "-" version))))
> > ...
> >
> > How do I calculate this 12fqh2d...?
> >
> > Dmitry Nikolaev
> >
> 
> You clone the git repository locally, then you use 'guix hash' as explained
> in this page of the manual (the option you want to use is "--recursive")
> 
> https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html

Please avoid doing the way described below though. Calculating it in
advance is more secure and helps to prevent introducing errors. If
there's a mismatch it shows an error.
 
> Another option is to try to build the package with the wrong hash, wait for
> the error message and copy the right hash from within the error message
> itself. Lame, but hey
> 
> Hope this helps !
> 
> Ciao

Re: guix hash of source from git repository.

[Leo Famulari]

On Wed, Feb 22, 2017 at 12:19:35AM +0300, Dmitry Nikolaev wrote:
> When writing package definition, what if I download sources from git
> repository? For example:
> 
> (define-public libwebsockets
>   (package
>     (name "libwebsockets")
>     (version "1.3")
>     (source (origin
>               ;; The project does not publish tarballs, so we have to take
>               ;; things from Git.
>               (method git-fetch)
>               (uri (git-reference
>                     (url "git://git.libwebsockets.org/libwebsockets")
>                     (commit (string-append "v" version
>                                            "-chrome37-firefox30"))))
>               (sha256
>                (base32
>                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
>               (file-name (string-append name "-" version))))
> ...
> 
> How do I calculate this 12fqh2d...?

Clone the Git repository in the normal way, check out the Git commit you
want to base the Guix package on, and then do this:

$ guix hash --recursive --exclude-vcs path/to/git-repo

This is explained in the manual, section Invoking guix hash:

https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html

Re: guix hash of source from git repository.

[Leo Famulari]

On Tue, Feb 21, 2017 at 09:56:29PM +0000, ng0 wrote:
> On 17-02-21 22:25:35, Catonano wrote:
> Please avoid doing the way described below though. Calculating it in
> advance is more secure and helps to prevent introducing errors. If
> there's a mismatch it shows an error.
>  
> > Another option is to try to build the package with the wrong hash, wait for
> > the error message and copy the right hash from within the error message
> > itself. Lame, but hey

I agree with ng0. We should not do this when creating Guix packages.

The guix download code has a relatively rare "network signature" when
compared to things like a web browser or wget.

Someone could serve a different file when they detect use of the Guix
download tool, and if this makes it into a package definition, all of
our users would end up with the wrong software.

Re: guix hash of source from git repository.

[Catonano]

[-- Attachment #1: Type: text/plain, Size: 1469 bytes --]

2017-02-21 23:17 GMT+01:00 Leo Famulari <leo@famulari.name>:

> On Wed, Feb 22, 2017 at 12:19:35AM +0300, Dmitry Nikolaev wrote:
> > When writing package definition, what if I download sources from git
> > repository? For example:
> >
> > (define-public libwebsockets
> >   (package
> >     (name "libwebsockets")
> >     (version "1.3")
> >     (source (origin
> >               ;; The project does not publish tarballs, so we have to
> take
> >               ;; things from Git.
> >               (method git-fetch)
> >               (uri (git-reference
> >                     (url "git://git.libwebsockets.org/libwebsockets")
> >                     (commit (string-append "v" version
> >                                            "-chrome37-firefox30"))))
> >               (sha256
> >                (base32
> >                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
> >               (file-name (string-append name "-" version))))
> > ...
> >
> > How do I calculate this 12fqh2d...?
>
> Clone the Git repository in the normal way, check out the Git commit you
> want to base the Guix package on, and then do this:
>
> $ guix hash --recursive --exclude-vcs path/to/git-repo
>
> This is explained in the manual, section Invoking guix hash:
>
> https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html
>
>

I apologize for the off the mark suggestion

I thought it was just lame, I didn't consider it had even more shortcomings

[-- Attachment #2: Type: text/html, Size: 2489 bytes --]

Re: guix hash of source from git repository.

[Ludovic Courtès]

Catonano <catonano@gmail.com> skribis:

> Hi Dmitry,
>
> 2017-02-21 22:19 GMT+01:00 Dmitry Nikolaev <cameltheman@gmail.com>:
>
>> When writing package definition, what if I download sources from git
>> repository? For example:
>>
>> (define-public libwebsockets
>>   (package
>>     (name "libwebsockets")
>>     (version "1.3")
>>     (source (origin
>>               ;; The project does not publish tarballs, so we have to take
>>               ;; things from Git.
>>               (method git-fetch)
>>               (uri (git-reference
>>                     (url "git://git.libwebsockets.org/libwebsockets")
>>                     (commit (string-append "v" version
>>                                            "-chrome37-firefox30"))))
>>               (sha256
>>                (base32
>>                 "12fqh2d2098mgf0ls19p9lzibpsqhv7mc5rn1yvrbfnazmcr40g4"))
>>               (file-name (string-append name "-" version))))
>> ...
>>
>> How do I calculate this 12fqh2d...?
>>
>> Dmitry Nikolaev
>>
>
> You clone the git repository locally, then you use 'guix hash' as explained
> in this page of the manual (the option you want to use is "--recursive")
>
> https://www.gnu.org/software/guix/manual/html_node/Invoking-guix-hash.html

Specifically, ‘guix hash -rx .’ on a fresh clone, as shown at the
bottom of this page.

Ludo’.