From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Reproducible installation images Date: Tue, 12 Dec 2017 10:27:46 +0100 Message-ID: <87indcs3cd.fsf@gnu.org> References: <87r2s6btbc.fsf@gnu.org> <87a7yssv0a.fsf@netris.org> <87shch4nn1.fsf_-_@gnu.org> <87374gkdmq.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:43154) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eOgqv-0001YR-LU for guix-devel@gnu.org; Tue, 12 Dec 2017 04:27:54 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eOgqr-0006fD-Lr for guix-devel@gnu.org; Tue, 12 Dec 2017 04:27:53 -0500 Received: from hera.aquilenet.fr ([141.255.128.1]:52501) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eOgqr-0006du-C6 for guix-devel@gnu.org; Tue, 12 Dec 2017 04:27:49 -0500 In-Reply-To: <87374gkdmq.fsf@netris.org> (Mark H. Weaver's message of "Mon, 11 Dec 2017 19:12:45 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mark H Weaver Cc: guix-devel@gnu.org Mark H Weaver skribis: > ludo@gnu.org (Ludovic Court=C3=A8s) writes: > >> Mark H Weaver skribis: >> >>> ludo@gnu.org (Ludovic Court=C3=A8s) writes: >>> >>>> Here are the bootable USB installation images and their signatures[*= ]: >>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.i686-linux.is= o.xz >>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.i686-linux.is= o.xz.sig >>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.x86_64-linux.= iso.xz >>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.x86_64-linux.= iso.xz.sig >>>> >>>> Here is the QCOW2 virtual machine (VM) image and its signature: >>>> https://alpha.gnu.org/gnu/guix/guixsd-vm-image-0.14.0.x86_64-linux= .xz >>>> https://alpha.gnu.org/gnu/guix/guixsd-vm-image-0.14.0.x86_64-linux= .xz.sig >>>> >>>> Here are the binary tarballs and their signatures[*]: >>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.i686-linux.tar.xz >>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.i686-linux.tar.x= z.sig >>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.x86_64-linux.tar= .xz >>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.x86_64-linux.tar= .xz.sig >>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.armhf-linux.tar.= xz >>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.armhf-linux.tar.= xz.sig >>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.aarch64-linux.ta= r.xz >>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.aarch64-linux.ta= r.xz.sig >>> >>> To enable independent verification of these installer images, it would >>> be helpful to include the precise commands needed to reproduce these >>> images, and the git commit to run them on. >>> >>> What do you think? >> >> The manual already gives those commands: >> >> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation= .html (bottom) >> https://www.gnu.org/software/guix/manual/html_node/Building-the-Instal= lation-Image.html > > They give the commands, but they do not provide the git commit that you > ran these commands on. True. So the announcements could say something like: See the =E2=80=9CBinary Installation=E2=80=9D and =E2=80=9CBuilding the I= nstallation Image=E2=80=9D sections of the manual on how to recreate these binary images. The =E2=80=98guix-binary=E2=80=99 tarballs were created from the =E2=80=98v0.= 14.0=E2=80=99 Git tag; the =E2=80=98guixsd-=E2=80=99 images were created from the tip of the =E2=80= =98version-0.14.0=E2=80=99 branch. Or maybe give the =E2=80=98git checkout/guix build=E2=80=99 sequence of com= mands? Thoughts? Ludo=E2=80=99.