[bug#60629] [PATCH 0/3] Add '--with-version' package transformation

["Ludovic Courtès" <ludo@gnu.org>]

Hello!

Simon Tournier <zimon.toutoune@gmail.com> skribis:

> On sam., 07 janv. 2023 at 16:04, Ludovic Courtès <ludo@gnu.org> wrote:
>
>> Now that updaters can (to some extent) import any upstream version, we
>> can provide a ‘--with-version’ package transformation option that picks
>> the given upstream version.
>
> Well, transformation bypasses the checksum control and so it is not
> really a fixed-output, right?

It’s not fixed-output at all because we don’t know in advance what we’ll
get from that download.

> Therefore, the result depends on the state of the world and thus it is
> not necessary reproducible.

Absolutely.

[...]

> All that said, this option is cool to have. :-) It is missing some
> guards, IMHO.  Maybe:
>
>  1. Wording some warning for the manual

Will do, that makes a lot of sense to me, I share your concerns.

>  2. Add comments about reproducibility when exporting manifest with
>     transformations; for example,
>
>     (define transform1
>       ;; WARNING: some transformation might lead to non-reproducible profile.
>       ;; For more details, please see the Package Transformation Options section.
>       (options->transformation
>         '((with-version . "python-numpy=1.22.4")
>           (with-c-toolchain . "python-scipy=gcc-toolchain@7"))))

This one’s a bit more involved technically because we don’t use (guix
read-print) yet here, so I prefer to do that separately.

>  3. Add a warning.  Similarly, to this:
>
>    warning: cannot authenticate source of 'python-numpy', version 1.22.4
>
>    For instance,
>
>    warning: transformation for 'python-numpy' with version 1.22.4 might be non-reproducible

I wonder about this one because it would be displayed unconditionally,
there’s no “I understand the risks” button one can click to make it
disappear.  I’d lean towards making a prominent warning in the manual
and not have a warning message every time here, dunno.

Thoughts?

Thanks for your feedback!

Ludo’.