Re: ‘guix publish’ now compresses archives

[Ludovic Courtès]

Hello Tomáš,

Tomáš Čech <address@hidden> skribis:

> As I am happy to see enthusiasm about Guix, I don't think that current
> archive format is usable for distribution of binary packages of
> whatever origin. Problem is that we have package definition as part of
> package manager GIT snapshot or local files but this information is
> not distributed along with the package archive.

I’m not sure what you mean.  The “substitute” mechanism is meant as a
cache.  Guix locally compiles the package recipe to a low-level
representation of the build process (a derivation), and then, it can
*optionally* ask substitute servers whether they have the result
corresponding to that derivation.

A derivation is self-contained and unambiguous.  I can do:

--8<---------------cut here---------------start------------->8---
$ guix build -d sed
/gnu/store/whkb4d5sq2326m54zpdz6hhmi37jy6j4-sed-4.2.2.drv
$ cat $(guix build -d sed) | cut -d ']' -f 1
Derive([("out","/gnu/store/4ls9kdy1w6ichvmbrl5wn98lxmznbkd6-sed-4.2.2","","")
$ wget -O /tmp/sed-binary.nar.bz2 
https://mirror.hydra.gnu.org/nar/4ls9kdy1w6ichvmbrl5wn98lxmznbkd6-sed-4.2.2
--2016-07-19 15:09:02--  
https://mirror.hydra.gnu.org/nar/4ls9kdy1w6ichvmbrl5wn98lxmznbkd6-sed-4.2.2
Ni solvigas mirror.hydra.gnu.org (mirror.hydra.gnu.org)... 131.159.14.26, 
2001:4ca0:2001:10:225:90ff:fedb:c720
Konektado al mirror.hydra.gnu.org (mirror.hydra.gnu.org)|131.159.14.26|:443... 
konektita.
HTTP peto sendita, ni atendas respondon... 200 OK
Grando: nespecifita [application/x-nix-archive]
Ni konservas al: '/tmp/sed-binary.nar.bz2'

/tmp/sed-binary.nar     [ <=>                ] 145.07K  --.-KB/s    in 0.07s   

2016-07-19 15:09:02 (2.04 MB/s) - '/tmp/sed-binary.nar.bz2' konservita [148549]
--8<---------------cut here---------------end--------------->8---

… and now I have the binary corresponds to that sed-4.2.2.drv, or so
claims mirror.hydra.gnu.org.  (This URL scheme is what ‘guix publish’
implements.)

Thus, mirror.hydra.gnu.org does not need to know about the (package …)
form, the Git revision of Guix, whether the recipe was local or not,
etc.

Of course I have to trust mirror.hydra.gnu.org to genuinely serve
binaries resulting corresponding to the derivations.  To express this
trust, I register its archive signing key, as explained at
<https://www.gnu.org/software/guix/manual/html_node/Substitutes.html>.

Does that clarify things, or am I misunderstanding?

Thanks,
Ludo’.