guix pull

guix pull

[Gottfried]

Hi,

how often do I have to do a "guix pull"? Once a week, or twice a week, 
or every second week?

Are there possibilities to know, when security updates are made and I 
should do a guix pull?

Should I do a guix pull basically in my user account?

Or should I do a guix pull basically in the root account?

As far as I understood if I do a gux pull in my user account, it has no 
influence to the root account?

But If I do a guix pull only in my user account, it would mean, as far 
as I understand it, the root account would not get security updates?

What should be the procedure?

Gottfried

Re: guix pull

[Leo Famulari]

On Wed, Feb 16, 2022 at 04:28:08PM +0000, Gottfried wrote:
> how often do I have to do a "guix pull"? Once a week, or twice a week, or
> every second week?

You never *have* to do it, but I recommend you do it at least once a
week, if that works for you. There are security problems fixed in every
update of packages with big codebases, such as browsers, kernels, etc.

> Are there possibilities to know, when security updates are made and I should
> do a guix pull?

Currently we only announce security fixes in Guix itself.  That is, we
do not announce security updates of packages, although we do often
mention them in the Git log:

https://git.savannah.gnu.org/cgit/guix.git/log/

> Should I do a guix pull basically in my user account?
> 
> Or should I do a guix pull basically in the root account?
> 
> As far as I understood if I do a gux pull in my user account, it has no
> influence to the root account?

Correct.

`guix pull` is per-user. Every user can do their own `guix pull`, and it
doesn't affect any other user. Root is just another user. There is
nothing special about root from this perspective.

> But If I do a guix pull only in my user account, it would mean, as far as I
> understand it, the root account would not get security updates?

Correct.

> What should be the procedure?

As each user that you wish to update, do `guix pull` to update Guix and
the list of available packages and services, and then do `guix upgrade`
to actually upgrade your packages. If you use Guix System, you upgrade
the system with `guix system reconfigure`.

Re: guix pull

[pelzflorian (Florian Pelz)]

On Wed, Feb 16, 2022 at 12:19:58PM -0500, Leo Famulari wrote:
> On Wed, Feb 16, 2022 at 04:28:08PM +0000, Gottfried wrote:
> > But If I do a guix pull only in my user account, it would mean, as far as I
> > understand it, the root account would not get security updates?
> 
> Correct.
> 
> > What should be the procedure?
> 
> As each user that you wish to update, do `guix pull` to update Guix and
> the list of available packages and services, and then do `guix upgrade`
> to actually upgrade your packages. If you use Guix System, you upgrade
> the system with `guix system reconfigure`.
> 


Note however that

sudo guix system reconfigure /etc/config.scm

uses the guix of the user who is running sudo.

See https://guix.gnu.org/en/manual/devel/de/html_node/Nach-der-Systeminstallation.html

It is therefore possible to never use root’s guix .

Regards,
Florian

Re: guix pull

[Gottfried]

thanks

is there a possibility to run a guix pull for root and for the user 
together, in order not to do it twice, because it needs quite a long 
time, compared to other Linux distros, where updating takes only some 
minutes. (Debian based distros, Manjaro, Endeavour OS and so on).

If you do a guix pull, in my case I can´t do it at the end of my work, 
because I would have to wait for finishing more than 30 minutes.

Is it not better to run a guix pull also regularly for root, in order 
that root has also updated versions...

In my understanding (as a layman) it would leave root behind and leads 
may be to inconsistency's in the guix system.


regards

Gottfried



Am 16.02.22 um 18:55 schrieb pelzflorian (Florian Pelz):
> On Wed, Feb 16, 2022 at 12:19:58PM -0500, Leo Famulari wrote:
>> On Wed, Feb 16, 2022 at 04:28:08PM +0000, Gottfried wrote:
>>> But If I do a guix pull only in my user account, it would mean, as far as I
>>> understand it, the root account would not get security updates?
>> Correct.
>>
>>> What should be the procedure?
>> As each user that you wish to update, do `guix pull` to update Guix and
>> the list of available packages and services, and then do `guix upgrade`
>> to actually upgrade your packages. If you use Guix System, you upgrade
>> the system with `guix system reconfigure`.
>>
>
> Note however that
>
> sudo guix system reconfigure /etc/config.scm
>
> uses the guix of the user who is running sudo.
>
> Seehttps://guix.gnu.org/en/manual/devel/de/html_node/Nach-der-Systeminstallation.html
>
> It is therefore possible to never use root’s guix .
>
> Regards,
> Florian

Re: guix pull

[Gottfried]

In other Linux distros there is always an immediate announcement if 
there are security updates and package updates available.

In guix system it seems, according to Your answer, it does not 
happen.      (May be in future if it will be developed?)

regards

Gottfried


Am 16.02.22 um 18:19 schrieb Leo Famulari:
> On Wed, Feb 16, 2022 at 04:28:08PM +0000, Gottfried wrote:
>> how often do I have to do a "guix pull"? Once a week, or twice a week, or
>> every second week?
> You never *have* to do it, but I recommend you do it at least once a
> week, if that works for you. There are security problems fixed in every
> update of packages with big codebases, such as browsers, kernels, etc.
>
>> Are there possibilities to know, when security updates are made and I should
>> do a guix pull?
> Currently we only announce security fixes in Guix itself.  That is, we
> do not announce security updates of packages, although we do often
> mention them in the Git log:
>
> https://git.savannah.gnu.org/cgit/guix.git/log/
>
>> Should I do a guix pull basically in my user account?
>>
>> Or should I do a guix pull basically in the root account?
>>
>> As far as I understood if I do a gux pull in my user account, it has no
>> influence to the root account?
> Correct.
>
> `guix pull` is per-user. Every user can do their own `guix pull`, and it
> doesn't affect any other user. Root is just another user. There is
> nothing special about root from this perspective.
>
>> But If I do a guix pull only in my user account, it would mean, as far as I
>> understand it, the root account would not get security updates?
> Correct.
>
>> What should be the procedure?
> As each user that you wish to update, do `guix pull` to update Guix and
> the list of available packages and services, and then do `guix upgrade`
> to actually upgrade your packages. If you use Guix System, you upgrade
> the system with `guix system reconfigure`.

Re: guix pull

[Leo Famulari]

On Wed, Feb 16, 2022 at 07:28:35PM +0000, Gottfried wrote:
> In other Linux distros there is always an immediate announcement if there
> are security updates and package updates available.
> 
> In guix system it seems, according to Your answer, it does not happen.     
> (May be in future if it will be developed?)

Overall, it's a complicated subject.

Different distros handle security updates in different ways. Some of
them are better than Guix, some are worse. And whether or not you think
they are better or worse depends on your preferences.

There is not a simple answer to "what is the right thing to do?" in
terms of security updates and advisories.

Guix is a distro run by volunteers, and nobody has volunteered to handle
advisories, nor has anybody offered to fund that work. So, it hasn't
happened yet.

Re: guix pull

[Ricardo Wurmus]

Gottfried <gottfried@posteo.de> writes:

> Should I do a guix pull basically in my user account?
>
> Or should I do a guix pull basically in the root account?
>
> As far as I understood if I do a gux pull in my user account, it has
> no influence to the root account?

This is correct.  As far as Guix is concerned “root” is just another
user account.

> But If I do a guix pull only in my user account, it would mean, as far
> as I understand it, the root account would not get security updates?

Correct.

Note that “guix pull” alone doesn’t upgrade any installed packages.  It
only gives you a new version of Guix which has access to updated packages.

> What should be the procedure?

You can have all users on the machine share the same guix and/or the
same profile and upgrade just that.

On a single-user system it also makes sense to just not install any
software for the root user.

-- 
Ricardo

Re: guix pull

[Gottfried]

If I do a guix pull at root, than the guix system is for root updated, I 
understood,

does it mean that's it, and I don´t need to do a

guix system reconfigure /etc/config.scm, which I do for the user?

Gottfried



Am 16.02.22 um 21:09 schrieb Ricardo Wurmus:
> Gottfried<gottfried@posteo.de>  writes:
>
>> Should I do a guix pull basically in my user account?
>>
>> Or should I do a guix pull basically in the root account?
>>
>> As far as I understood if I do a gux pull in my user account, it has
>> no influence to the root account?
> This is correct.  As far as Guix is concerned “root” is just another
> user account.
>
>> But If I do a guix pull only in my user account, it would mean, as far
>> as I understand it, the root account would not get security updates?
> Correct.
>
> Note that “guix pull” alone doesn’t upgrade any installed packages.  It
> only gives you a new version of Guix which has access to updated packages.
>
>> What should be the procedure?
> You can have all users on the machine share the same guix and/or the
> same profile and upgrade just that.
>
> On a single-user system it also makes sense to just not install any
> software for the root user.
>

Re: guix pull

[Ricardo Wurmus]

Gottfried <gottfried@posteo.de> writes:

> If I do a guix pull at root, than the guix system is for root updated, I understood, 
>
> does it mean that's it, and I don´t need to do a 
>
> guix system reconfigure /etc/config.scm, which I do for the user?

There seems to have been a misunderstanding; sorry for confusing you.

“guix pull” only updates the “guix” command.  It does so by installing a
new version of Guix (+ whatever channels you may have configured) to
~/.config/guix/current.  You can then use that new “guix” command to
upgrade or install new software.

“guix system reconfigure config.scm” on the other hand changes the
operating system according to the configuration file “config.scm”.
There’s only one system-wide operating system.  This action can only be
performed by the “root” user because it affects *all* users on the same
machine.

-- 
Ricardo

Re: guix pull

[Gottfried]

Now I did a guix pull in root.

It asks me at the end:


Hinweis: Nachdem Sie `PATH' festgelegt haben, sollten Sie `hash guix' 
ausführen, damit Ihre Shell `/root/.config/guix/current/bin/guix' verwendet.

What does it mean?

How do I "PATH"...


Gottfried



Am 16.02.22 um 21:09 schrieb Ricardo Wurmus:
> Gottfried<gottfried@posteo.de>  writes:
>
>> Should I do a guix pull basically in my user account?
>>
>> Or should I do a guix pull basically in the root account?
>>
>> As far as I understood if I do a gux pull in my user account, it has
>> no influence to the root account?
> This is correct.  As far as Guix is concerned “root” is just another
> user account.
>
>> But If I do a guix pull only in my user account, it would mean, as far
>> as I understand it, the root account would not get security updates?
> Correct.
>
> Note that “guix pull” alone doesn’t upgrade any installed packages.  It
> only gives you a new version of Guix which has access to updated packages.
>
>> What should be the procedure?
> You can have all users on the machine share the same guix and/or the
> same profile and upgrade just that.
>
> On a single-user system it also makes sense to just not install any
> software for the root user.
>

Re: guix pull

[Ricardo Wurmus]

Gottfried <gottfried@posteo.de> writes:

> Hinweis: Nachdem Sie `PATH' festgelegt haben, sollten Sie `hash guix' ausführen, damit Ihre Shell `/root/.config/guix/current/bin/guix'
> verwendet.
>
> What does it mean? 
>
> How do I "PATH"...

Your shell (by default that’s GNU Bash) has a few builtin commands, but
when you type something like “ls” or “guix” it has to search for an
executable of that name on your disk.

It searches the directories that are listed on the PATH environment
variable.  You can see the value of PATH by running

    echo $PATH

This will be a colon-separated list of directories that can be expected
to contain executables.  When you type “guix” and hit enter your shell
visits the directories listed in this PATH variable one by one until it
finds an executable with the name “guix”.  It then remembers the
location so that it doesn’t have to do all that work again.

The hint above tells you to put ~/.config/guix/current/bin *first* on
the list of directories in the PATH variable, so that when the shell
goes to search for “guix” it will look there first and find
~/.config/guix/current/bin/guix — and not /usr/local/bin/guix or
whatever else might exist on your disk.

Since bash might have already remembered that “guix” corresponds to
“/usr/local/bin/guix” you need to tell it to forget about that and look
again.  That’s what “hash guix” does.

You can set PATH permanently by adding or modifying a line in the
~/.bash_profile file, which is read once when Bash starts.  Or you can
set it just in the current shell session.

In any case, setting this variable is done like this:

    export PATH=/home/gottfried/.config/guix/current/bin:$PATH

This changes the value of PATH so that
“/home/gottfried/.config/guix/current/bin” appears first, followed by
the current value of PATH.  You can add this line to the bottom of
~/.bash_profile and then start a new shell session (e.g. by logging out
and in again).

-- 
Ricardo