Dear Guix,

GNU sources are usually shipped as tarballs with some pre-compiled
sources included. This can be a bit scary at times, so the question now
is, can we skip the tarballs and build everything from human-authored
sources?

I first want to emphasize that distributing generated sources is an
important feature of a build system. It is necessary for it to boast
cross-compilation support, and for packages doing simple forms of
introspection (such as using help2man or gobject introspection) it may
even be sufficient. There are other nice things as well, so with that
in mind, let us open the black box and see what the maintainers are
hiding from us.

I chose Hello. After a bit of guixing around, it works:

guix build -f hello.scm

shows the build, and

guix build --source -f hello.scm

shows the full source distribution (although it is not in a tar because
it would have additional reproducibility problems).

So, what are the hello maintainers hiding from us?
— they use gnulib;
— the translations are not in the git repository, so their release
process involves fetching stuff from the web and packing it in;
— the manpage generation depends on the presence of a ".git" folder;
— they have perl installed;
— they have a bunch of autotools, included code generators (gperf);
— they work in the git repository to have a meaningful version number
and commit log (for the ChangeLog);
— the manual displays its revision date, but we don’t know how it is
computed (I suspect the revision date is the last time the maintainer
who did the release edited or git-pulled the texinfo source, which,
let’s agree on that, is not very precise).

I could not fully recover the release source (I am not attempting bit-
reproducibility) because:
— the translations were lost;
— the ChangeLog was lost;
— the manual revision date was lost;
— guix’ patched shebangs leaked in the sources.

This is a mixed responsibility problem. The big point here is
translations. I understand that using translationproject.org means that
committing the translations would storm the repository with automated
commits, which would be undesirable. Maybe Software Heritage could
help?

Happy hacking!

Vivien