[bug#49898] [PATCH v5] gnu: Add spectre-meltdown-checker.

[Liliana Marie Prikler]

Hi Petr,

sorry for the very late reply.  Are you still interested in adding
spectre-meltdown-checker?  If so, there's a new version out.  Also...

Am Dienstag, dem 07.12.2021 um 22:04 +0000 schrieb phodina:
> I've used the wrap-program as an alternative to the your suggested
> solution.
That does work, but remains quite inelegant.

> Going through the program there is a function update_fwdb [1] that
> downloads and updates database files when the script is executed with
> the --update-fwdb argument.
> 
> I've added both files [2][3] in question to the lists of inputs.
> 
> However, since they are supposed to be updated at runtime (stored in
> $HOME) I don't know to represent this in the package definition.
> 
> Could you please suggest how to proceed?
I'd suggest removing that functionality as well as the associated
inputs (i.e. curl etc., not the databases).  Even if it's treated as
"just data", users should be able to specify on their own the data to
check against.  Perhaps you could suggest to upstream that adding --
fwdb /path/to/fwdb might be useful?

Since this patch is rather old, there are a few style-related changes
that should also be incorporated:


> +    (arguments
> +     `(...))
Use a list of G-Expressions.

> +                   (paths (map
> +                           (lambda (input)
> +                             (string-append (assoc-ref inputs input)
> "/bin"))
> +                           '("coreutils" "grep" "util-linux"
> "iucode-tool"
> +                             "util-linux-with-udev" "gawk" "gzip"
> "lzop"
> +                             "lzop" "perl" "procps" "sqlite" "wget"
> "which" "xz" "zstd"))))
You can use (search-input-file inputs "/bin/CMD") to search CMD from
inputs.
> +    (inputs `(("binutils" ,binutils)
> +              ("coreutils",coreutils)
> +              [...])
You can drop the input labels, but you'll have to find another way to
pass the firmware databases.  Speaking of which, is anything even done
with those?  Could we add (a) separate package(s) with those databases
instead?

Cheers