From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp10.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms5.migadu.com with LMTPS id 6BeoG9dIwGMRgwEAbAwnHQ (envelope-from ) for ; Thu, 12 Jan 2023 18:52:23 +0100 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp10.migadu.com with LMTPS id UB64GtdIwGNrMgAAG6o9tA (envelope-from ) for ; Thu, 12 Jan 2023 18:52:23 +0100 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id F1C472346D for ; Thu, 12 Jan 2023 18:52:22 +0100 (CET) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pG1gM-00047l-BY; Thu, 12 Jan 2023 12:48:06 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pG1gJ-00045r-PO for guix-patches@gnu.org; Thu, 12 Jan 2023 12:48:03 -0500 Received: from debbugs.gnu.org ([209.51.188.43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1pG1gJ-0003xc-Gr for guix-patches@gnu.org; Thu, 12 Jan 2023 12:48:03 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1pG1gJ-0002qV-Df for guix-patches@gnu.org; Thu, 12 Jan 2023 12:48:03 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#60629] [PATCH 0/3] Add '--with-version' package transformation Resent-From: Simon Tournier Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Thu, 12 Jan 2023 17:48:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 60629 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?UTF-8?Q?Court=C3=A8s?= , 60629@debbugs.gnu.org Cc: h.goebel@crazy-compilers.com, Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 60629-submit@debbugs.gnu.org id=B60629.167354563310719 (code B ref 60629); Thu, 12 Jan 2023 17:48:03 +0000 Received: (at 60629) by debbugs.gnu.org; 12 Jan 2023 17:47:13 +0000 Received: from localhost ([127.0.0.1]:48532 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1pG1fV-0002mi-8i for submit@debbugs.gnu.org; Thu, 12 Jan 2023 12:47:13 -0500 Received: from mail-wr1-f42.google.com ([209.85.221.42]:41964) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1pG1fK-0002lA-AZ for 60629@debbugs.gnu.org; Thu, 12 Jan 2023 12:47:03 -0500 Received: by mail-wr1-f42.google.com with SMTP id w1so18855353wrt.8 for <60629@debbugs.gnu.org>; Thu, 12 Jan 2023 09:47:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:references :in-reply-to:subject:cc:to:from:from:to:cc:subject:date:message-id :reply-to; bh=7d6G1ue1PwFUs2Y30d2/PbxceLZgxpl2lZab/6ikld0=; b=D3SI90qTzT2yICEftxJhkZ+38+GKLeOfdp9AhoRqjJB6ZUL+GJL2ZZnycccbTkWUiF FYfoOBTdr2pTaGx4PWNveXMTI5V54u4hvjkCWv3/OzL/Hlqp7lJoah9e29F0TXTACXqX iwjbmkg3zwqj0mfaPRoMHHScxKJUaEI0zJEPrsePcqoKtXFuXLnZpPau48P0Y7ls1gsD rDFgV/IL3kfHhzEA815/dVKvW/xg27OQ9+ZUakL8dgoSRxh9FexBzX1EgunkHodDmgsB yUkkSdkh+/eiZyHNpFgCjcIpzL73EsjsvwoMCicFoI1V3RczrAfdILv9FaoyP330ygGd PQYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:references :in-reply-to:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=7d6G1ue1PwFUs2Y30d2/PbxceLZgxpl2lZab/6ikld0=; b=5WDS0d1hckJ7o+YgR2o0zX1xMuu3GdWdlnSo7ltHxv2YRvFdDXhwHsDr8ai1hJWhFl UMOuk05Zl7Mong/476hL834Hq6H75t5xcn3sSp0jMMmc2ohKiY6GZA6wDkag3IoUuDuC bgRSgCS57Hg8b4ElVFegr/R/3IztriDQBOGg2h7BFJlVwG3rX4lSiOB8a4PbMONZmiuz gtYJASkxEtdpJsaI3vmImd6Nq2O9WFptIvYWFbdq9X4/OhDAnRHzel2ek+PH+lOlZWrq ukLaN1+/ZDu3ar22dIY+m2u5ox22FaOZIm5G3AGJEwmrm7WewWP/c2tlKZDNNxoFQczH rEaw== X-Gm-Message-State: AFqh2kpilg8woz2a4gIclqUIPMKM7YNC33RiF1x9IQlA8q6/fRd0I0D2 bYcBsfVm3W6e6hs1M+DrjZQ= X-Google-Smtp-Source: AMrXdXvNHCcJDERxjsz1EpPWUEzdHTLr5uvyW5wCJZbn2t0GU5aCCiE34Z1OYG7jpCqR8yR+UeyXPg== X-Received: by 2002:a5d:5e87:0:b0:269:2b69:e9b3 with SMTP id ck7-20020a5d5e87000000b002692b69e9b3mr11582241wrb.0.1673545616772; Thu, 12 Jan 2023 09:46:56 -0800 (PST) Received: from pfiuh07 ([193.48.40.241]) by smtp.gmail.com with ESMTPSA id i15-20020a05600011cf00b00294176c2c01sm16875952wrx.86.2023.01.12.09.46.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 Jan 2023 09:46:56 -0800 (PST) From: Simon Tournier In-Reply-To: <20230107150457.4446-1-ludo@gnu.org> References: <20230107150457.4446-1-ludo@gnu.org> Date: Thu, 12 Jan 2023 16:49:58 +0100 Message-ID: <87o7r3wy55.fsf@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+larch=yhetil.org@gnu.org Sender: guix-patches-bounces+larch=yhetil.org@gnu.org X-Migadu-Country: US X-Migadu-Flow: FLOW_IN ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=gmail.com header.s=20210112 header.b=D3SI90qT; spf=pass (aspmx1.migadu.com: domain of "guix-patches-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-patches-bounces+larch=yhetil.org@gnu.org"; dmarc=fail reason="SPF not aligned (relaxed)" header.from=gmail.com (policy=none) ARC-Seal: i=1; s=key1; d=yhetil.org; t=1673545943; a=rsa-sha256; cv=none; b=hvtPNMPgRZZJq/2rMdmmVMmNI1HoDzDO2SU6971GFDU2ItvbNtivbW7pjXoUsxEGWdWGAd F1UxInrL7Ibjb4cLyzeUiG4KMxfM00WLzQLs4n30M4SKquKDdcZnUEgDmTNAGUtuzn1xmc 6bTVQQ/HI2SzfbKt5RdH1/I9spJO6DyQ2bffTDfgvq0+SqP1XA/jeqo6IO5sFfrvFrjnFL wH1Q+e1i5Ny5wP6vBzoVRfr35H9siCBDUJZRVVBnHfv3nj+jMWzRq0ezn6MQxlua/xCc2X mMmLY+iVXOsas7tQc/mX3C9+5Dl9jrjyXYY9pfqbtDZyKOpMf27TunTHtfa87g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1673545943; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:resent-cc: resent-from:resent-sender:resent-message-id:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=7d6G1ue1PwFUs2Y30d2/PbxceLZgxpl2lZab/6ikld0=; b=GC3ckHRSyPO9SgTYH1vkLQjG1zJShTS82DLDeNdyMYixnzZ/SOmDsMF9jU3RTB65e5Ua0X ACZWI5Kg8PsFBtzHUyZZAPiAI9RE1RObhbo8Tf+nCcRlbCahfwaNMzcPbmcVXbMeRzYf4q BnrnioVwbcFM5HRgqBGiyDpOzLvA4nr788gY7i3ctaLlsTwIHxbIFnPlZuMP0ySNIIqwMK Sj9Q89OeScf+GeIN+BXfh7IYn1o/KKPcB7GTuUkf7Df8dO/c+oJYs56TGuPFfbaXmyuK01 ZxbRosTFvjy2DlLhDp9Xi5+zcvOzhmp+lBw4B0TezHjkQXzyv99e0TDFpVjw4A== X-Migadu-Queue-Id: F1C472346D X-Migadu-Scanner: scn0.migadu.com Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=gmail.com header.s=20210112 header.b=D3SI90qT; spf=pass (aspmx1.migadu.com: domain of "guix-patches-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-patches-bounces+larch=yhetil.org@gnu.org"; dmarc=fail reason="SPF not aligned (relaxed)" header.from=gmail.com (policy=none) X-Migadu-Spam-Score: -1.00 X-Spam-Score: -1.00 X-TUID: Kb8TwVRpfdJq Hi, The code LGTM. Minor the comment below. :-) On sam., 07 janv. 2023 at 16:04, Ludovic Court=C3=A8s wrote: > Now that updaters can (to some extent) import any upstream version, we > can provide a =E2=80=98--with-version=E2=80=99 package transformation opt= ion that picks > the given upstream version. Well, transformation bypasses the checksum control and so it is not really a fixed-output, right? Therefore, the result depends on the state of the world and thus it is not necessary reproducible. While --with-latest (or other transformation) makes this potential unreproducibility clear, that=E2=80=99s not the case with --with-version. For instance, Alice runs guix shell python python-scipy --with-version=3Dpython-numpy=3D1.22.4 and the result depends on what upstream provides for Numpy@1.22.4. Even if Alice provide a channels.scm file pinning Guix, then Bob does not get necessary the same as Alice with: guix time-machine -C channels.scm \ -- shell python python-scipy --with-version=3Dpython-numpy=3D1.22.4 Moreover, with my hat dealing with scientific folk, I already see their confusion. For instance, they will write some manifest such that, --8<---------------cut here---------------start------------->8--- (use-modules (guix transformations)) (define transform1 (options->transformation '((with-version . "python-numpy=3D1.22.4")))) (packages->manifest (list (transform1 (specification->package "python")) (transform1 (specification->package "python-scipy")))) --8<---------------cut here---------------end--------------->8--- which looks very similar to some requirements.txt or other YAML variants consumed by well-known other package managers. ;-) It is confusing because the common motto is =C2=ABGuix is reproducible by design=C2=BB but then here it is not. And what happens if the upstream content pointed by --with-version=3Dpython-numpy=3D1.22.4 is not available? It is not possible to fallback. All fall downss. Well, my concerns are also valid for other transformations but their names are clear enough to ring some bell for reproducing. The name =E2=80=99with-version=E2=80=99 appears to me a trap because it eases incorr= ect description of the computational environment while thinking doing it right because using Guix. The issue is the connotation of the term =E2=80=9Cversion=E2=80=9D (*). (*) term =E2=80=9Cversion=E2=80=9D: people are often confused with the = difference between source code version and produced binary version containing compilation options and dependencies; or also confused with the difference between extrinsic reference as label or tag and intrinsic reference as checksum. All that said, this option is cool to have. :-) It is missing some guards, IMHO. Maybe: 1. Wording some warning for the manual 2. Add comments about reproducibility when exporting manifest with transformations; for example, (define transform1 ;; WARNING: some transformation might lead to non-reproducible profil= e. ;; For more details, please see the Package Transformation Options se= ction. (options->transformation '((with-version . "python-numpy=3D1.22.4") (with-c-toolchain . "python-scipy=3Dgcc-toolchain@7")))) 3. Add a warning. Similarly, to this: warning: cannot authenticate source of 'python-numpy', version 1.22.4 For instance, warning: transformation for 'python-numpy' with version 1.22.4 might be = non-reproducible Cheers, simon