Re: List of installed package, version pairs

[Jack Hill]

On Wed, 16 Jan 2019, Gábor Boskovits wrote:

> Hello Jack,
> you could also try to make sense of the individual profile generation
> manifests.
>
> The union of those should give a farily comprehensive list, and it comes with 
> versions.

Yes, this looks pretty good, thanks. I think that this gets me all the 
surface packages exposed in all the profiles. However, I believe that it 
is still missing the packages installed as dependencies.

One thought is to drop back to manipulating store objects. I can get a 
list of references using query-path-info from the guix store module, and 
recurse down those references to build the graph. In the end I have to 
then guess the package names and versions from the store paths.

> From my experimentation, it seems that store paths/objects are really what 
Guix works with and is aware of, and not package names and version that 
are reported as what's installed on traditional distributions. Perhaps I 
can convince our security office to be happy with store paths.

Thoughts?
Jack