Foreign packages and reproducibility (formerly Re: [PATCH] gnu: Add ruby-nokogiri)

[Pjotr Prins <pjotr.public12@thebird.nl>]

I am thinking about this again. It is relevant for all interpreters.

The real pain is that between Ruby interpreters the profile can be shared which
contains a path to the modules, e.g. say ruby-nokogiri. Currently you can run

  guix package -i ruby ruby-nokogiri
  ruby -e "require-2.2.1 'nokogiri'"

next update ruby to a new (minor) version 

  guix package -i ruby-2.2.2

and run again

  ruby -e "require 'nokogiri'"

will work.

which is wrong because nokogiri was built against the first ruby interpreter.
It is a problem from the view point of reproducible software execution.

To prevent this we should *not* allow modules (i.e. nokogiri) in the
profile.

But now a user doing a simple

  ruby -e "require 'nokogiri'"

will fail, because the interpreter does not know where nokogiri
is. This is wrong because users should be able to access installed
gems (that is the point of having gems!).

One suggestion is wrappers and runpaths. I.e. wrap the invocation of
'ruby' with a script that will pass in the path to all installed gems.

Q1: is there a limitation to the length of such a path (generally a
    bash variable)?

Q2: would the wrapper be updated every time a new gem gets installed?
    How can we be sure it is deterministic? Installation order may matter.

Q3: can we query guix on-the-fly for paths to all leaf nodes that
    depend on a ruby? That way a wrapper could be installed
    once. Would that be too slow? How can we be sure it is
    deterministic?

I do not know how nix solves it exactly, but I do know they use a
wrapper script.

Finally, I do think that most Ruby gems should propagate ruby
itself. Only rarely are gems executables. Mostly they are libraries,
which implies you need to run ruby to run them. Right? It does not
make sense to install a Ruby library without the ruby interpreter.

Pj.