[bug#64861] [PATCH] guix: Add lint check for guix as propagated-input

[Karl G. Hallsby]

Christopher Baines <mail@cbaines.net> writes:

> [[PGP Signed Part:Undecided]]
>
> Karl Hallsby <karl@hallsby.com> writes:
>
>> * guix/lint.scm (new check): Run lint check warning user if the provided
>> package uses guix as a propagated-input.
>>
>> Passing guix as a propagated-input is problematic when users install a 
>> package
>> into their profiles. This can cause the guix propagated by the package to be
>> used in preference of the real one in $HOME/.config/. It was first noticed on
>> IRC with https://logs.guix.gnu.org/guix/2023-07-22.log#044534, and reproduced
>> with a different package 
>> https://logs.guix.gnu.org/guix/2023-07-25.log#054737.
>> ---
>>  guix/lint.scm | 14 ++++++++++++++
>>  1 file changed, 14 insertions(+)
>
> I'm not sure this lint warning is helpful as in both cases mentioned in
> the IRC links you provided (guile-imanifest and guix-data-service),
> these packages provide Guile modules that depend on Guix, and therefore
> the guix package is expected in their propagated inputs.
>
> If you remove guix or make it a input instead of a propagated input,
> then this breaks using the package, for example, with this change:
>
>   modified   gnu/packages/guile-xyz.scm
>   @@ -2098,8 +2098,10 @@ (define-public guile-imanifest
>          (build-system guile-build-system)
>          (native-inputs
>           (list guile-3.0))
>   +      (inputs
>   +       (list guix))
>          (propagated-inputs
>   -       (list guile-readline guile-colorized guix))
>   +       (list guile-readline guile-colorized))
>          (home-page "https://sr.ht/~brown121407/guile-imanifest";)
>          (synopsis "Interactive Guix manifests")
>          (description "This package provides functions to generate Guix 
> manifests
>
> Using guile-imanifest breaks:
>
>   → ./pre-inst-env guix environment --pure --ad-hoc guile guile-imanifest -- 
> guile -c "(use-modules (imanifest))"
>   Backtrace:
>     ...
>
>   ice-9/boot-9.scm:3330:6: In procedure resolve-interface:
>   no code for module (guix profiles)
>
>
> I think some other approach is needed to avoid people having problems
> with the guix package appearing in their users profile.
>
> [[End of PGP Signed Part]]

That makes sense. Though, this lint is just a warning, so if nothing
else, it should make people think if guix really needs to be propagated.
If this lint is not the solution, then a way to mark packages that are
not recommended to be installed like this would be nice.