Re: guix time-machine, broken hash in an old package definition, a workaround?

[zimoun <zimon.toutoune@gmail.com>]

Hi,

On Fri, 22 Jan 2021 at 12:36, Wiktor Żelazny <wz@freeshell.de> wrote:

> Would be cool, however for MRAN you also need the snapshot date. Would
> it be feasible to extract it from the commit date? There are dates at

Extract date from ~/.cache/guix/checkouts/pj... and author date of the
commit provided at the time-machine should the good one to provide to
MRAN.


> CRAN, but for the archived package versions these are “Last modified”.
> There is also “Date/Publication:” field in the tarball, but you wouldn’t
> trust a tarball with a hash mismatch.

About trust and mismatch, I would say: it depends.  You can still
download the new 'r-foreign@0.85' served by CRAN with the mismatch and
audit by hand.  Well, that's another story.

> I cannot check it. This approach works, but for some mysterious reason
> it also works when I remove the r-foreign-fixed definition and constrain
> the manifest to r. Without the definition, I would expect guix to try
> building r-foreign from CRAN. I thought that maybe guix treated
> r-foreign@0.8-75 and r-foreign@0.8-75-fixed as exchangeable because of
> the same hash, even if the versions and URIs differed, and so did not
> try to build r-foreign@0.8-75, but used r-foreign@0.8-75-fixed from the
> store. However, with `guix time-machine … -- build r-foreign@0.8-75`,
> I’m getting a different output than for `guix time-machine … -- build
> r-foreign@0.8-75-fixed`. I tried `guix gc <path to r>` to force the
> rebuild, but I got the “still alive” error, even though I had exited the
> environment.

To rebuild, the easiest is the option "build --check".

> I will just trust your expertise on that, and keep your solution. I can
> always go back to the inferior if it turns out to fail when I encounter
> the hash mismatch problem sometime in the future.

As I see it, there are 2 options:

 _ option 1: write the package definition with the new MRAN source (or
with the CRAN source but with the new checksum hash), and a manifest
file.  Then run

  $ guix time-machine --commit=d81fb2a \
              -- environment -m manifest.scm

The trick here is to use "--with-input"; somehow the graph has to be
rewritten.  At the manifest level, it is something with
"transform-package-inputs"

 _ option 2: use another package transformation:
"transformation-package-sources".  The new API is simpler with
"package-with-source", so the manifest could contain...

   (packages->manifest
     (cons
        (package-with-source r-foreign
"https://cran.microsoft.com/snapshot/2020-01-27/")
        (map specification->package
           (list "r"
                  "r-another-package"))))

...But the issue is that "package-with-source" was not so simple at
commit d81fb2a time.  And the way is "transformation-package-sources"
even if I am not convinced it is simpler than create by hand the
correct 'r-foreign' package with option 1.


> Have a nice weekend,

Have a nice week-end too! :-)

All the best,
simon