Grafts

[ludo@gnu.org (Ludovic Courtès)]

[-- Attachment #1.1: Type: text/plain, Size: 938 bytes --]

Hello,

I pushed ‘wip-grafts’, a branch that implements “grafts.”

Normally security updates deep in the DAG, such as an update of Bash or
libc, cause a rebuild of everything, which can some time, as we’ve seen
lately.

The idea of grafts is to graft the fixed package on any packages users
may want to install.  So, suppose there’s a libc fix; when installing
IceCat, you’ll just be starting from the (pre-built) IceCat, and an
additional derivation will patch the files in it to replace references
to the old libc with references to the fixed libc (in practice this only
works if the file name of the old and fixed libc have the same length.)

‘wip-grafts’ adds a ‘graft’ field to package records.  In the example
above, we’d just add a ‘graft’ field to glibc, pointing to the fixed
glibc, and the graft would just be automagically applied.  The branch
has an example of that with Bash:


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: Type: text/x-patch, Size: 910 bytes --]

--- a/gnu/packages/bash.scm
+++ b/gnu/packages/bash.scm
@@ -185,7 +185,13 @@ allows command-line editing, unlimited command history, shell functions and
 aliases, and job control while still allowing most sh scripts to be run
 without modification.")
      (license gpl3+)
-     (home-page "http://www.gnu.org/software/bash/"))))
+     (home-page "http://www.gnu.org/software/bash/")
+     (graft bash-fixed))))
+
+(define bash-fixed                                ;FIXME: Use something real.
+  (package (inherit bash)
+    (version "4.3.42")
+    (graft #f)))
 
 (define-public bash-light
   ;; A stripped-down Bash for non-interactive use.
@@ -210,4 +216,5 @@ without modification.")
 
                  ,@(if (%current-target-system)
                        '("bash_cv_job_control_missing=no")
-                       '()))))))))
+                       '()))))))
+    (graft #f)))

[-- Attachment #1.3: Type: text/plain, Size: 523 bytes --]


The implementation looks for ‘graft’ fields in all the transitive inputs
of the package being built.

Currently it works but needs more testing and documentation.  There are
also performance issues that need to be worked out.

Comments welcome!

The general idea was implemented by Shea Levy in Nixpkgs¹, and also
suggested by Mark Weaver on IRC, who helped refine how things should
work in Guix–thanks!

Ludo’.

¹ https://github.com/NixOS/nixpkgs/commit/d1662d715514e6ef9d3dc29f132f1b3d8e608a18

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]