bug#29177: Hidden packages are not accounted for by `guix refresh`

[ludo@gnu.org (Ludovic Courtès)]

Hi Marius,

Marius Bakke <mbakke@fastmail.com> skribis:

> Currently, some packages are marked as "hidden".  This makes `guix
> refresh` fail to realize the full impact of a change.  Most notably this
> affects 'xorg-server': there have already been a few commits that
> rebuilds the for-test variant (and thus GTK) because they seemed to only
> cause ~150 rebuilds, where in reality it's more than 400:
>
> 97ecd75e289d96a8b4f9b1ae877d9d1a2f6774b4 gnu: libxfont: Fix CVE-2017-13720, CVE-2017-13722.
> c2eb8cd98c82277e851eb4302b7f12614e215a76 gnu: xorg-server: Build reproducibly.
> 9371600ec8397ab3d596dea89c388b4acb1c2437 gnu: libxres: Update to 1.2.0.

Oooops!  I’m the guilty party here.  The real dependency count can be
found with:

--8<---------------cut here---------------start------------->8---
$ guix refresh -l -e '(@ (gnu packages xorg) xorg-server-1.19.3)' xorg-server
Building the following 276 packages would ensure 516 dependent packages are rebuilt: snd@17.7 ardour@5.12 …
--8<---------------cut here---------------end--------------->8---

The problem is not that ‘xorg-server-1.19.3’ is hidden (we can work
around it with -e), but that it inherits from ‘xorg-server’, and thus
ended up being rebuilt.

That’s a “known limitation” of ‘guix refresh -l’ and not something
easily addressed since inheritance is purely syntactic.  Tricky!

So I think it’s “not a bug” from the ‘guix refresh’ viewpoint, but it’s
definitely a mistake on my side.  Apologies!

I think at this stage it’s no longer useful to revert this commit
though.  WDYT?

Thanks for the heads-up!

Ludo’.