Re: Upgrading packages with substitutes only (bug #26608)

[Ricardo Wurmus <rekado@elephly.net>]

Timothy Sample <samplet@ngyro.com> writes:

>>> In my opinion “--only-substitutes” should stop and report a list.
>>> If it continued without complaining there could be problems:
>>>
>>> * partial upgrades could leave the profile in an unusable state
>
> Maybe I don’t understand Guix that well yet, but I don’t think this is
> possible. At least I don’t understand how it would happen. Under the
> hood, the “--only-substitutes” flag would basically just be an
> intelligent “--do-not-upgrade” flag. Can I ruin my profile by misusing
> “--do-not-upgrade”?

There are many cases where partial profile upgrades are okay, especially
if software is independent.  Problems usually arise when you have things
like Python modules in your profile.  Upgrading some Python modules but
not others might lead to problems at runtime.

Arguably, one should be using manifests anyway when consistency is
required.

>>> * an attacker could use this to trick a user into thinking that they
>>>   have all available updates
>
> I can always run
>
>     $ guix package -n -u
>
> to learn what packages are out of date. (Except if I get frustrated by
> the fact that Guix is building a package to check if is different from
> an installed package and mash C-c C-c. :))
                                ^^^^^^^

Oh, another “M-x shell” user :)

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net