From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp11.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms5.migadu.com with LMTPS id kOOtMzuYJGPLagEAbAwnHQ (envelope-from ) for ; Fri, 16 Sep 2022 17:37:31 +0200 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp11.migadu.com with LMTPS id CAykMzuYJGO7FwAA9RJhRA (envelope-from ) for ; Fri, 16 Sep 2022 17:37:31 +0200 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 8ECAD18822 for ; Fri, 16 Sep 2022 17:37:31 +0200 (CEST) Received: from localhost ([::1]:37792 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oZDPG-0001VO-Bn for larch@yhetil.org; Fri, 16 Sep 2022 11:37:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:57564) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oZDOR-0001ST-6I for help-guix@gnu.org; Fri, 16 Sep 2022 11:36:39 -0400 Received: from mail-lf1-x134.google.com ([2a00:1450:4864:20::134]:45580) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oZDOO-0002fz-On for help-guix@gnu.org; Fri, 16 Sep 2022 11:36:38 -0400 Received: by mail-lf1-x134.google.com with SMTP id w8so36171983lft.12 for ; Fri, 16 Sep 2022 08:36:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=worcester-edu.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date; bh=7SJP5sKQ8A2oZ8Dmp1phFEeWmCW9FcEoUEV95nwKYew=; b=hoBtU7/3+lddoFZWbw067dmlPsXXsZWuTIztdM8plJ3NYUdWNbX1FxY+5/MnkO47Ia EnxzWySXlyUtoE5PuINA28g8zbKw1W899GqPMrpGTEx/XT/UNTvdGqUZNa1HN7t/HjGt JaoeGvG/Ki5UepawG+hemZMt8uHforTM82ukpXMvAoJsuqn+NWLogfkSHj6Kh3nLuWRr O4ZD4WrmXjdCYrP17H/FsfN0eHYTODKQlsxg5SZwiISSOvDUPEokVzQcCwTRGdVAFE/2 w9uSDpTBhoS5wp4zMoR7qWV6agO2/Ok1o2dUWrbxOUeQQFvGjp7hFfCoF7wSu8n8ZalV bRJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date; bh=7SJP5sKQ8A2oZ8Dmp1phFEeWmCW9FcEoUEV95nwKYew=; b=b0u5nDXsc7omdqcPrgN9WCycTn9anruwyWFM7J2zJGiHrMVLN7Z0ECg0put39XUvB+ Yk8+siGwm3UAFLIM+xYVtMrUqIlCViIEIZ7Ik/26sPZlvRL4jIACbmTGOFFA50IAHt8T PRSP1zrNodDQicDCQ/xRpeAIfpy1ArcQTtcSqrjLXWloIj8DR3HkowLdDZQQ95WFkgen UkOE6kVR4TZPb7KdSqd7O5e0hLHGuPIAztuzJRavGhRZYanFVmS9WRUAvv7uzDuR+sB1 4tKrpcJKIauOb9zwdm0cYhPeTN1r99yYjSJ1BFgrcLNDBu/Lp+mrKC+b9sZiE1G032BX vE/g== X-Gm-Message-State: ACrzQf3IFE3isVtUYJ3JrUYWn7Cl3xOlG51l+agW31yhp/XIFL2QZan+ wiLmYLEG9Cl6Y2G0HqUyBW1df7AwUWMgLibAS3vjlWx8P5HpGA== X-Google-Smtp-Source: AMsMyM6vKfXI5vKa1zGdaGqC7zOQRrZm634RBE8GWdrvWa17jrXYPVOJlwoVtq/KyQUsXATDnX3/sj2VrRP9GIXa0eo= X-Received: by 2002:a05:6512:36c1:b0:497:abef:cce5 with SMTP id e1-20020a05651236c100b00497abefcce5mr1904072lfs.472.1663342594367; Fri, 16 Sep 2022 08:36:34 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: "Thompson, David" Date: Fri, 16 Sep 2022 11:36:23 -0400 Message-ID: Subject: Re: Understanding the Guix approach when language package managers are around To: Daniel Sockwell Cc: help-guix Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass client-ip=2a00:1450:4864:20::134; envelope-from=dthompson2@worcester.edu; helo=mail-lf1-x134.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: help-guix@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+larch=yhetil.org@gnu.org Sender: "Help-Guix" Authentication-Results: aspmx1.migadu.com; none X-Migadu-Scanner: scn1.migadu.com X-TUID: UMKkBToaqVJs Hi Daniel, On Fri, Sep 16, 2022 at 10:48 AM Daniel Sockwell wrote: > > Hi all, > > (I also asked this question in r/guix; sorry if you're seeing it > twice.) > > I'm trying to understand how Guix "wants" me to install software > that's in language package managers, such as npm, Leiningen, etc. > My current approach to installing some non-packages software > gives me the feeling that I'm fighting against Guix -- usually a > clear sign that I'm missing something. > > Here's a specific example (though note that I'm asking about overall > approaches; I'm not currently seeking help debugging this specific > install). I use a keyboard with open-source firmware and would like > to install the configuration utility, Chrysalis > (https://github.com/keyboardio/Chrysalis) for that firmware. > > My first step, of course, was to check if Guix packages Chrysalis > (it's licensed under GPLv3, so we could); but we don't package it. > From the project `README`, I see that Chrysalis is distributed as an > AppImage, so on any other distro I'd use that. However, I know that > AppImages don't cooperate well with Guix, so that's out. The `README` > also shows that Chrysalis is a JavaScript program (actually an > Electron app), so the normal/non-Guix installation would be to run > `npm install` and go from there. > > I can think of two ways to proceed: > > 1. Install Node/npm and attempt to install Chrysalis just like I > would on any other distro This is the way I would recommend, if you can get it to work. > 2. Attempt to package Chrysalis via Guix (probably using the > `node-build-system`) and then install it normally As you explain below, here be dragons. :( > But both of these approaches give me the feeling that I'm Doing It > Wrong=E2=84=A2. With the first, I immediately hit errors about libraries= not > being where Node expected. I might be able to work around those (a > guide on the mailing list seems promising > https://lists.gnu.org/archive/html/help-guix/2018-06/msg00052.html). > But, even if I did, I'd be left with a package that is entirely > outside Guix's functional model -- which seems like a hint that this > isn't the Guix approach. Yes, ideally, everything could be managed with Guix. However, with node, this is the best that you can do right now. > But looking into option 2 (packaging Chrysalis) doesn't seem promising > either. My understanding is that packaging Chrysalis involves listing > its dependencies as `inputs`. And that could be hard. Chrysalis has > ~40 dependencies most of which aren't packaged for Guix. And many of > those dependencies have their own transitive dependencies -- the full > graph seems to include 1,534 programs (for comparison, Guix currently > packages 51 `node-*` programs). Given that I'm fairly new to Guix, I > very much doubt I should be trying to package a bunch of software. > Plus, even if I did, I doubt Guix would want to host an order of > magnitude more Node packages. So, again, I get the sense that going > this route would be fighting against Guix instead of working with it. Unfortunately, you're right. Many have tried to untangle the mess, but no one has succeeded. Here's a blog post from 2015 that illustrates some of the problems: https://dustycloud.org/blog/javascript-packaging-dystopia/ Unfortunately, the problems are still the same in 2022. Huge dependency trees with likely multiple versions of *the same library* in it, circular dependencies when "dev dependencies" (aka the stuff you need to build from source) are taken into account, missing licenses, binary blobs with no source, proprietary code, etc. It's a real mess. > So that's my question. Are one of those approaches correct and I'm > just confused on the details? Or is there some other approach to > installing this GPLv3 software that's the "real" Guix approach? Or is > this sort of multi-dependency JavaScript app just a weak point for > Guix at the moment? Guix's highly reproducible, source-based approach is very much at odds with the npm model of distribution which is effectively the polar opposite. If you can sort out your issues with making the npm tool work on a Guix system, I would just go that route for lack of a feasible alternative. Sorry for the bad news! Good luck! - Dave