<ryanprior>So far it works fine, but I want to test whether using the system deps for those things could work. Any idea how I should go about modifying my package to use guix? Anybody dealt with something like this before?
<ryanprior>I'm not sure whether those vendored deps have patches applied to them, I've asked upstream for guidance. But I'd like to mess with it. :)
<ruffni>ryanprior: input seems undefined. are you sure this is the way to refer to the inputs of the package definition?
<ryanprior>Guix will pass inputs as a keyword argument to your function I think
<enderby>when i run the ExecStart command i specified it runs fine
<ryanprior>I do not know anything about running services installed from Guix using systemd, but I'd like to learn
<reepca>does guile have anything like common lisp's prog1 by default? Where, for example, I could run (prog1 (open some-file) (do-something-else)) and have it still return the result of open?
<ryanprior>Can you link to what your current setup looks like? Maybe in a GitLab snippet or something?
<pkill9>going into guix environments is a lot snappier now that manual-database.drv is marked unsubstitutable :)
<ryanprior>Anybody know why `guix package` and `guix build` take an -f argument but `guix environment` wants a -l argument for the same thing?
<ryanprior>environment doesn't use -f for anything, could we make that do what -l does (and maybe deprecate -l in environment since it's used for list-generations in package and thus kinda overloaded?)
<ryanprior>I guess maybe these are thoughts I should send to guix-devel
<butterypancake>hello! So I'm trying to install guix but the installer is being quite buggy. Is there a can generate a disk image from the latest source? At least one of my problems seems to have been solved already but not in 1.1.0
<butterypancake>is the guix package managment and the guix system distribution found in the same git repository?
<bandali>i mean i think ideally i'd want it to be a direct debian derivative, but i've come to accept and love it for what it is :-)
<drakonis>trisquel already updates once every 2 years doesnt it?
<bandali>i'd say that's pretty major and important around gnu and gnu projects ;-)
<drakonis>seems kinda weird to not just track debian already
<bandali>re updates, yeah its slow release has been a bit slow
<bandali>but i think they've been working to improve that
<drakonis>i see ubuntu derivatives track ubuntu lts and think "man why not just track debian instead, seems like the sane option"
<bandali>i think for trisquel that's a historical thing, and apparently ubuntu has been easier to get up and running / more friendlier than debian perhaps, and i think those are at least part of the reasons why trisquel was based on ubuntu initially
<ryanprior>I, on the other hand, see people grouse about ubuntu or trisquel for not being debian and think "debian is right there if you want it."
<alextee[m]>did someone change the manual pages database building thing? seems to be faster now
<raghavgururajan>sneek, later tell nckx: I have missed your replies to #40603, as I am not subscribed to mail-list. I just saw your replies, when I revisited the bug thread via web. I have now replied to thread. :-)
<alextee[m]>it tells me it's gonna downgrade if i install gtk+@2
<ryanprior>alextee: I think you could install them in different profiles, or have packages that want different versions in the same profile
<ryanprior>I don't think there's any such thing as two versions of the same package in a single profile, though. Guix creates a link to what "gtk+" means in the current context, and it has to point to some particular version.
<ryanprior>alextee: so if you're in a position where you ultimately do really need to have gtk2 and gtk3 in the same profile at the same time, I believe you could create a new package (called eg gtk+-2) that just packages one of them, install that package, and then install the other version normally.
<ryanprior>But then, supposing some of their output files have exactly the same name? In that case I'm not sure how you'd resolve that within a single profile.
<ryanprior>So your solution might be to use two profiles. That sounds tricky, somebody else please correct me if I'm overthinking this!
<peanutbutterandc>I was looking at the binaries in my $GUIX_PROFILE/bin (I am on a foreign distro), and all of them seem to be owned by root (obviously, because guix-daemon); however, they run as my user...
<peanutbutterandc>On the same vein, I have a guix-installed binary (`newuidmap` from the package `shadow`) that I need to setuid (because it is being denied access to proc directory). Given the clear warning in the guix reference manual to not touch the STORE manually, how - and should - one go about setuid-ing a guix-installed binary?
<peanutbutterandc>I guess I'm just really confused how the binaries in the store that are owned by root are accessible to unprivileged users without any clear setuid or something going on... and what does that mean, security-wise...
<reepca>stuff in the store is always world-readable, writable-by-nobody, non-setuid, non-setgid. The only variable part is the executable bit.
<reepca>on guix system we get around this by having a system service that sets up setuid binaries outside of the store
<reepca>... which, come to think of it, would be a great way to figure out how exactly to do that
<peanutbutterandc>so... how does emacs, that is in /gnu/store, that is owned by root, and has no setuid, runs from a 1000 uid user's profile? I am really curious
<reepca>setuid ON means "set (effective) user id to owner of program", setuid OFF means "keep whatever privileges the executing process currently has"
<peanutbutterandc>Now, guix reference manual clearly says that nobody should manually touch the STORE... but I would like to setuid this binary.... should I do it, or would that be a super stupid thing to do?
<reepca>you may be interested in ACTIVATE-SETUID-PROGRAMS on line 229 of ~/.config/guix/current/share/guile/site/3.0/gnu/build/activation.scm
<reepca>modifying it in the store would be a bad thing to do, aye
<reepca>it looks like what we do is basically just copy the executables out of the store and chmod the result
<peanutbutterandc>*sigh* :( I am afraid I am not yet that knowledgeable to do ACTIVATE-SETUID-PROGRAMS thing but I'll try to look around...
<peanutbutterandc>reepca, okay.... o this (activate-setuid-programs) thing... I suppose it is for guixSD systems and not for foreign distros... or is it?
<reepca>there's probably a reason we don't do it this way, but you could create what is essentially a setuid-symlink (but not actually). It would just be a shell script that executes ~/.guix-profile/sbin/<your-program>, and you would then make that setuid.
<peanutbutterandc>And, is the package definition defining programs to be setuid? I haven't yet run into any setuid programs (it seems) so far in my guix usage as a 'foreigner'
<reepca>actually, I can see a major flaw with doing it that way: if a malicious user temporarily gains control of your account, they could replace ~/.guix-profile with whatever they wanted, and the script would execute it with root privileges
<peanutbutterandc>reepca, Ummhmm... wikipedia article on setuid says that setuid bit only works on binaries...
<reepca>package builds may produce setuid binaries, but the permission bits are always canonicalized before it's copied into the store and has its permissions changed (it's actually kind of tricky to do safely because of race conditions)
<peanutbutterandc>Makes sense. The more I delve into guix, and per-user isolated everything, the more I find myself wishing HURD was complete. I've heard HURD is like super well crafted and there's per-user-everything there
<peanutbutterandc>Also, reagarding 'sandboxing' which seems to be all the rage these days and flatpak's main selling lines: does guix also do sandboxing? It does seem to me that guix is superior over all universsal package managers, but I haven't yet understood if it does 'sandboxing'
<reepca>it could be said that we do "sandboxing" of builds currently, but AFAIK no sandboxing by default of programs run by the user.
<reepca>there's guix environment -C, which could be considered a type of sandboxing
<peanutbutterandc>Ahh.... I've been told `guix pack` can basically replace flatpak (for the most part)
<reepca>it can produce self-contained bundles, but doesn't do anything to restrict the privileges of those bundles or what they can do.
<reepca>which is what I assume you meant by sandboxing
<peanutbutterandc>reepca, Yes, I understand. hence "(for the most part)". :) Once we have the sandboxing thing down, we can probably rule the galaxy
*rekado_ manually frees up space on ci.guix.gnu.org again
<peanutbutterandc>Another question: I have a problem showing up in guix on one machine, whereas the problem does not manifest itself in another one (both foreign distros). Am I to consider the problem specific to the computer and the host-configs (which I am not sure should be relevant) or should I report them and/or talk about them here with the devs to figure things out? Would the difference count as a build-reproducibility issue?
<peanutbutterandc>One of the three problems I am trying to deal with at the moment is font issues on my Elementary OS machine. Devanagari fonts are not showing, despite font-lohit being installed, and the issue only manifests itself in generations post generation 59 (before an upgrade). I did another upgrade too, but to no avail.
<pinoaffe>peanutbutterandc: fonts are quite finnicky in guix, so I'd say just report it
<peanutbutterandc>pinoaffe, But the isssue just manifested itself. And it hasn't been that way. I have used guix as a package manager on foreign distros on 6 machines so far and all of them have worked all right, except this... and it's only in the generationss prior to the upgrade. *sigh*
<peanutbutterandc>I have no idea how is that even possible. I've even used guix time-machine --commit=guix-describe-commit-from-another-machine-where-emacs-works -- install emacs; but that didn't do it either
<peanutbutterandc>which makes me think that there must be something in my system: I suspect my own home directory, why that issue is manifesting itself. hmm... I should probably create a test user to test the theory out. If the isssue manifests itself for the other user too, it means a system issue and not a home-dir one.
<Kimapr[m]>idk, didn't try that, but it doesn't work right away
<Kimapr[m]>maybe running the script from that h-node page would make it work on trisquel
<Kimapr[m]>ah, the page says that its tested with 5.5.0 version of linux-libre
<ecbrown>i would work in very simple steps, first make sure the wifi works with distro with considerable heft behind it.
<bricewge>Kimapr: You wrote a package for the driver of your wifi card, If I remember correctly. Is it loaded in memory; ie does lsmod report it?
<peanutbutterandc>so... regarding my issue that I was testing earlier (fonts not working, emacs not working); I tested on the same machine with a new user and used a manifest file (to check all the issues) and the only issue that manifested again was the emacs gtk issue
<peanutbutterandc>Now, I've been poking around with rootless docker today. And I did manage to set it up manually using the shell script they provide; but in trying to set it up using guix, I have run into a few confusions....
<peanutbutterandc>is there any reason why guix does not package dockerd-rootless.sh and friends that they provide from the website?
<thomassgn>I just started, though, so I'll see if I figure it out on my own, but if anyone has that knowledge readily available I'd be quite happy :)
<peanutbutterandc>thomassgn, Hey there, I am not an expert (just learning, and very much a n00b) but you might find something helpful in the "origin Reference" section of the guix manual. `info guix "origin reference"`, if you have info reader. There you'll find 'patches' and 'snippet' which might be, I think, what you might be looking for. (Sorry I don't know much nix, and am very much n00b in guix)
<thomassgn>peanutbutterandc: Cool, I'll check it out. :)
<peanutbutterandc>thomassgn, Well, we should not forget that guix is a package manager, first and foremost. Haha :D
<TZander>Docker derives its value from generic functionality which you can find in many apps and it also is useful because there are so many pre-build images.
<peanutbutterandc>TZander, it's excruciating right now. I've been on it for the entire day today. Did manage to get it running with docker-supplied script, yes. But now I want to do it using guix and the docker-supplied wrapper around dockerd (dockerd-rootless.sh) which
<TZander>If you don't want to just run a specific image, you might want to play with the containers feature build into guix.
<peanutbutterandc>....is when I came to the realization that at least 3 binaries that they installed (with the installer script) come from an undisclosed source.
<peanutbutterandc>TZander, I have a docker image I'd like to run... I know that guix can export something akin to docker image for packages (or sth, I don't remember exactly); but I don't suppose I can go the other way around
<peanutbutterandc>TZander, Oh wow... that seems.... neat.... that my-image is from the current directory, I presume?
<TZander>the big advantage with guix is that the software comes from the guix repository. You don't have to trust a random huge download of essentially a whole stack.
<peanutbutterandc>TZander, so, I suppose I could do something like `guix environment --container --ad-hoc bash -- super-shady-looking-script.sh` too. Interesting. Or, rather a binary, instead of a script.
<peanutbutterandc>that seems like an entire virtualization thing...rather than containerization...... I wonder if someone knows how to get rootless docker working with guix on a foreign distro
<peanutbutterandc>there is an --experimental and a --rootless flag in the dockerd supplied by guix; but that doesn't seem to be enough, and there isn't any documentation regard6ing how to get it working
<peanutbutterandc>Pl6e6a6s6e excuse me my k6eyboa6rd6 is ma6lfunctioning. need to s6witch computers
<devtexa>I used guix enviroment --container to create an environment to test and compile my project, but it is missing /usr/bin/env, how should this be solved?
<ecbrown>devtexa: you can add a special-files-service-type
<ecbrown>(wait, not sure that works in your context)
<devtexa>I don't have GuixSD, I am Guix running on AlpineLinux
<TZander>devtexa: +1 on fixing downloading. I'd like to see downloading from a single host should not disconnect and reconnect every time.. (creating a second or two between files from the ci host)
<apteryx>3rd problem: At least when using Guix System on a Btrfs RAID1 array atop LUKS, GRUB behavior is to query for the LUKS of every drive in the array, even if the drive went missing, and prevents further booting of the machine.
<apteryx>There might be a 4th problem, I'm not sure: perhaps the mapped-devices (handled by the initrd I guess block booting when one of them fails -- I coudn't really test that given the other issues.
*apteryx will try tackling those issues over the coming weeks (months?)
<TZander>apteryx: If not already, I suggest ou use the guix issue tracker for that
<jojoz[m]>NieDzejkob: Haha ok. I don't expect perfect security or I'd be talking to a professional and using encrypted CPU enclaves or whatever. I just figured I'd ask in case there's some obvious flaw in security that's not intended to be fixed due to it not being a goal.
<tom_>devtexa, I've installed font-terminal but setfont isn't find ter-v12n etc, do you know what I need to do for setfont to find it?
<devtexa>Wait, where do you refer to the terminal, terminal emulator?
<devtexa>Or the one based on framebuffer on Linux?
<jojoz[m]>NieDzejkob: Looks interesting, very fine-tuneable. And I guess Guix doesn't do the syscall fuzzing? Do you know if it's much better otherwise? Using Guix would be much more familiar and convenient for me.
<tom_>Yeah the root Linux terminal, the framebuffer I suppose
<tom_>Yeah I'm sure that has the answer somewhere, would be good to change the font before I read it though.
<NieDzejkob>jojoz[m]: Hmm, I've seen nsjail being used to organize a CTF, which is basically when we let random security-minded people from the internet execute arbitrary code on purpose, and it hasn't failed us yet. No idea how secure a Guix container is.
<thomassgn>slightly related to resource use; a year back I tried setting up cgroups here, I don't remember the details now. But has anyone got cgroups or something along those lines working? I know they are in guix, at least as part of elogind, but havent found much.
<bricewge>TZander: I'll give it a try. I just got commit rights yesterday so bear with me.
<devtexa>Wget works fine after I created a soft link
<butterypancake>ok. I cannot for the life of me bootstrap the bootable image on my arch linux machine. And the current 1.1.0 installer is too buggy for me to use. Should I try the 1.0.1 installer or is it possible for someone to upload a 1.1.1 for me?
<mothacehe>butterypancake: do you happen to have a guix checkouted somewhere?
<butterypancake>So I installed guix onto my arch linux machine from source (because the aur guix package is broken). But when it trys to build certain packages like ghostscript and a few others, it throws errors. When I go through the logs, it's an error at the make level. So It calls make, and I guess I don't have the proper make or something like that. You know dependency hell. This prevents me from being able to generate an ISO
<butterypancake>sorry for the late response. I'm techniqually working right now :P
<butterypancake>I guess another take away here is someone should look at the guix AUR package.
<dutchie>it should be able to find the right make when you are building guix packages
<butterypancake>so when I run guix pull, it's using guix packages to compile? not system packages?
<janneke>mbakke: oops, wrt the native-inputs: of course -- sorry!
<thomassgn>I don't understand what I'm doing wrong here: during install phase, parafrased I get: entering directory '/tmp/guix-build-wkhtmltopdf-.../src/lib' mkdir: cannot create dir '/include': permission denied... I'll post the package asap
<janneke>mbakke: hmm, i assumed that "all" my cross-build work would be OK for core-updates...so i need to rethink that
<janneke>just like the gnu build system doesn't need overrides/patching when it's used properly by a package
<janneke>i would hope that the same would go for this qt build system
<janneke>...but it could be that the package is doing something special
<thomassgn>mm. this package is somewhat strange. They have a separate repo for distribution and production builds and it says to build in docker or other container because it used to require a patched qt, it seems no more, but the build is still strange.
<thomassgn>Thanks anyway janneke :) Always good to gain some insight :)
<pinoaffe>I want my laptop to automatically keep an open ssh connection to a server (for port forwarding and the like), and to retry when connections are lost / internet access is regained - I think the guix way (tm) to do this would be to write a service, am I right in that regard, and is there code/services in guix that I could build upon?
<pinoaffe>joshuaBPMan: I'm not aware of any projects to make an open source client for zoom, and think the odds of that happening are quite low because zoom seems to be rather opposed to the idea and because they're nto the type of company free software fanatics generally would want to interact with
<butterypancake>ya, I think. guix seems to install stuff in random order but I stoped failing on certain things after I did that. But now I got these new problems that are preventing me from making the ISO
<lhp22>Hello there ! I'm a new user of Guix (I'm installing GuixSD on a virtual machine and reading the manual). I don't understand what does a `guix install` done by root. Does it mean that the installed package will be installed only for the root user ? Not in the whole system ?
<NieDzejkob>(see gnu/system/file-systems.scm:360 for the details on that)
<ryanprior>I'm working on updating a package (oil-shell in guix) and upstream would like to change the name to "oil" since that's the official title. Can we change package names? Can I introduce a new package "oil" and make oil-shell into an alias for it or something?
<rekado_>ryanprior: yes, search for deprecated-package
<thomassgn>xavierm0229: guix build <package-name> or readlink $(which <package-name>) is what I use in bash. Not sure if that's what you mean though?
<ryanprior>rekado_: awesome thank you, what should the commit message look like when I'm deprecating a package?
<ryanprior>Should I do this as two patches in a series, one which renames the package and then another that updates it? Or all in one patch?
<xavierm0229>thomassgn It's for a package I've just defined to I need a scheme function :/
<xavierm0229>More precisely, I'm trying to transform a single package into several packages, one per phase of the original package, in order to cache the phases
<xavierm0229>So if I have two phases A and B, I need to give the uri of the package corresponding to A as source to the package representing B
<xavierm0229>(I think I'm nearly there. After I manager to get the URI, the only remaining thing is getting the sha)
<rekado_>ryanprior: personally, I’d do it in two steps.
<rekado_>xavierm0229: in Scheme you’d use a G-expression to get the output directory of another package.
<pinoaffe>amom: rollback stuff is in the gnu store, which is mounted at /gnu/store. It can be put on a separate disk, but needs to be available at all times as it contains *all* program-files and the like, not just the ones to roll back to
<civodul>rekado_, bricewge: my bandwidth to ci. is back to normal today
<bricewge>civodul: Can I add my keys to build-aux/authenticate.scm or will it screw with "make authenticate"?
<lfam>mbakke: I'm glad to hear it works on core-updates. I was tracking the RCs but never figured out why it was failing the test suite. I had to use more recent kernel headers to make it build at all. I think that's actually a bug in QEMU; apparently QEMU should provide the newer headers itself
<mbakke>lfam: ooh, I figured out the test suite failures, but did not understand why it failed to build on "master", thanks for the headers tip
<lfam>"That struct should be defined in linux-headers/linux/vfio.h"
<lfam>"One possibility is that the machine has older kernel headers installed and QEMU's code is including <linux/vfio.h> in certain files where the system header will be found instead of QEMU's up-to-date header (a copy of the file from recent Linux)"
<lfam>"That would be a bug in QEMU's code or makefiles. I'm not 100% that this is the case you are seeing, but it's a possibility."