Guix support in cachix

Guix support in cachix

[Oleg Pykhalov]

[-- Attachment #1: Type: text/plain, Size: 275 bytes --]

Hello Guix,

Domen Kožar <domen@dev.si> recently was in #guix (IRC) 2 days ago asking
about support of Guix in cachix.  Also he opened an issue on GitHub:

> I'm opening this issue for interest around supporting Guix.

[1] https://github.com/cachix/cachix/issues/85

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: Guix support in cachix

[Ludovic Courtès]

Hello!

Oleg Pykhalov <go.wigust@gmail.com> skribis:

> Domen Kožar <domen@dev.si> recently was in #guix (IRC) 2 days ago asking
> about support of Guix in cachix.  Also he opened an issue on GitHub:
>
>> I'm opening this issue for interest around supporting Guix.
>
> [1] https://github.com/cachix/cachix/issues/85

Cachix looks interesting!  It’s good to collaboratively provide
binaries.  It’s easier than having everyone set up ‘guix publish’, at
the cost of being more centralized.

The “cachix use <name>” example on https://cachix.org/ glosses over
security “details” though.  I wonder how one gets to authenticate a
particular user of Cachix and to authorize binaries coming from them.
There’s also the issue that said user could be publishing binaries they
themselves obtained from a source that you do not trust yourself.  Tough
issues!

Ludo’.

Re: Guix support in cachix

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 1400 bytes --]

ludo@gnu.org (Ludovic Courtès) writes:

> Hello!
>
> Oleg Pykhalov <go.wigust@gmail.com> skribis:
>
>> Domen Kožar <domen@dev.si> recently was in #guix (IRC) 2 days ago asking
>> about support of Guix in cachix.  Also he opened an issue on GitHub:
>>
>>> I'm opening this issue for interest around supporting Guix.
>>
>> [1] https://github.com/cachix/cachix/issues/85
>
> Cachix looks interesting!  It’s good to collaboratively provide
> binaries.  It’s easier than having everyone set up ‘guix publish’, at
> the cost of being more centralized.
>
> The “cachix use <name>” example on https://cachix.org/ glosses over
> security “details” though.  I wonder how one gets to authenticate a
> particular user of Cachix and to authorize binaries coming from them.
> There’s also the issue that said user could be publishing binaries they
> themselves obtained from a source that you do not trust yourself.  Tough
> issues!

I asked about discovering signing keys and apparently you'll find it at
https://<user>.cachix.net, and that's the substitute URL too.

It looks useful for those who don't want to or can't publish their own
substitutes.  And `guix challenge` makes it easy to verify the builds
coming from a particular "channel".

I would not want to publish all my builds there, though.  Not sure how
it would be integrated on the client side.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: Guix support in cachix

[Ludovic Courtès]

Hello,

Marius Bakke <mbakke@fastmail.com> skribis:

> It looks useful for those who don't want to or can't publish their own
> substitutes.  And `guix challenge` makes it easy to verify the builds
> coming from a particular "channel".

I agree that it can be useful.

I would very much like it if we had a solution that did not rely on a
central service, though.  If ‘guix publish’ could publish over
BitTorrent, say (or GNUnet, like we tried during GSoC a few years ago),
that would be awesome.

Thanks,
Ludo’.

Re: Guix support in cachix

[Nils Gillmann]

Ludovic Courtès transcribed 540 bytes:
> Hello,
> 
> Marius Bakke <mbakke@fastmail.com> skribis:
> 
> > It looks useful for those who don't want to or can't publish their own
> > substitutes.  And `guix challenge` makes it easy to verify the builds
> > coming from a particular "channel".
> 
> I agree that it can be useful.
> 
> I would very much like it if we had a solution that did not rely on a
> central service, though.  If ‘guix publish’ could publish over
> BitTorrent, say (or GNUnet, like we tried during GSoC a few years ago),
> that would be awesome.

Let me interject for a second:
while I think work towards GNUnet makes sense (I haven't stopped following
my plan; going beyond just substitutes via FS),
we have some problems in GNUnet which need to be resolved first before
you can throw something at its FS. We have upcoming changes to FS in
the predictable near future after the 0.11 release which hopefully start
addressing changes we need in FS.
In the meantime, not trying to derail: amz3 did really good work with
the new Guile bindings for gnunet. Is anyone up to taking the bindings
further? If you would like to but you are having trouble setting up
either the bindings or gnunet itself for hacking, contact us and
we will be able to work something out. I can give you git access to
this repo. Even documenting it more than right now will be a big win
for other guile hackers!

Since my impression over the years was that Guix wants to embrace a
pluralism of distribution methods and not be fixed on one or two
ways to do it: writing integrations for bittorrent, ipfs, or whatever
could lead to fragmentation and while I technically don't really see
the point, it could be done. not every existing solution will work
in every location, but worst case we are getting some nice guile
bindings for other applications out of it ;)

> Thanks,
> Ludo’.
>