IRC channel logs

<jaft_r>fnat: I did until Emacs29 became the current stable version. I haven't been running Emacs30 since then, though.

<fnat>jaft_r: Hey, thanks. Yes, I was also on emacs-next around that time. It might be a good time to switch back to it now, it looks like things are progressing towards a release upstream.

<noel>hey guys i've been on guix system for ~2 days now and i just reconfigured successfully > rebooted > pc won't boot. Going back to a previous generation works fine & boots, but trying to reconfigure into the new config which initially successfully built returns error "error parsing derivation '/gnu/store/xxxxx-system.drv': expected string 'Derive(['

<noel>"

<noel>guix gc --verify=repair,contents doesn't fix the issue and i haven't really been able to find another solution in the irc logs

<AwesomeAdam54321>Hi everyone, is there a way to use the old input style only for 1 input and the new style for the rest?

<AwesomeAdam54321>I don't know what's the equivalent of (("googlemock" ,(package-source googletest)) in the new input style

<jaft_r>AwesomeAdam54321: Would not just using (package-source googletest) work? The old style was ("name-of-package" package-variable) so, under the new style, (list package-variable-1 package-variable-2 package-variable-3) should let you just sub (package-source googletest) in for where it expects a package.

<jaft_r>Took me a bit to find but it looks like the =iwd= package has an example of this very use-case: https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages/networking.scm#n4128

<AwesomeAdam54321>jaft_r: Thanks! It works

<nigko>Hello Guix! I have stumbled upon non-standard 'let' form on line 221 in https://git.savannah.gnu.org/cgit/guix.git/tree/guix/channels.scm:

<nigko>(let ((directory commit branch (repository-info directory)))

<nigko> ...)

<nigko>Here 'repository-info procedure returns maltiple values. Does anybody know where this modified let form come from?

<nigko>It is not in standard Guile modules. So, where this syntax is defined?

<lilyp>nigko: SRFI 71

<peanuts>"SRFI 71: Extended LET-syntax for multiple values" https://srfi.schemers.org/srfi-71/srfi-71.html

<nigko>lilyp: Thanks!

<Xeroine>What's the "correct" way to use the guix guile modules that are already there in the ~/.config/guix/current? From what I read that profile is just supposed to store some stuff for guix itself unlike ~/.guix-profile which is the default profile to install packages. I have guile installed in the ~/.guix-profile but since that profile doesn't have the guix modules I can't use them from that profile.

<Xeroine>~/.config/guix/current doesn't export GUILE_LOAD_PATH or GUILE_LOAD_COMPILED_PATH, just the PATH, so I added the guile site directory with guix modules to my GUILE_LOAD_PATH in .bashrc but I don't think this is the right way to do this. Some modules that are dependencies of the one I imported fail to compile and there a bunch of unbound variable warnings.

<Xeroine>I don't get what you're supposed to do to get it working, any advice?

<Xeroine>This on a non-guix system by the way, I'm just using it as a package manager

<Rutherther>Xeroine: bin/guix under ~/.config/guix/current has the correct modules to use under it. Just look into its contents and you will see that it points to the correct locations in the gnu store. That's why only putting it to your PATH is fine, and will get you updated version of guix channel and others you specify in ~/.config/guix/channels.scm

<Rutherther>since you are on non-guix system, it might also be good idea to update the guix-daemon to point to the newly made guix inside the gnu store instead of the one your system installed (probably being 1.4.0 release)

<bost>Hi. When running a Guile script I get 'WARNING: compilation of /path/to/file.scm failed: In procedure mkstemp: Permission denied'. Does anybody know why?

<Xeroine>Rutherther: I see, so the ~/.config/guix/current/bin/guix adds stuff to the load path to find the guix modules and runs guix-main but I want to use these modules in my own guile program. Should I just be copy pasting the same paths it appends into my guile program then?

<Rutherther>Xeroine: no, maybe this will help you: https://systemreboot.net/post/deploy-scripts-using-g-expressions but I am not sure why you want to use the modules in the first place, so maybe it won't

<Xeroine>for creating images using `guix system image`

<Rutherther>Xeroine: then yeah, that seems like you should package your script, and you can do that with g-expressions, see the article for that

<Xeroine>I just wanted to create an image for my aarch64 board (rpi 4b) but I couldn't get it to cross-compile some packages from the x86_64 PC on which I installed guix, it always kept failed at gawk-mesboot

<Xeroine>so now I'm trying on my the M1 Air I got which is aarch64

<Xeroine>and thanks, I'll check out the link

<jaft_r>I'm, unfortunately, heading to bed, bost, but you may want to share the script you're trying to run. That'll likely better help others triangulate the cause of error. Also, maybe, how you're trying to run said script.

<Xeroine>yeah I'll post it again here later maybe, already asked about it but I guess not many people use guix with a aarch64CPU

<Xeroine>aarch64 CPU*

<bost>jaft_r: thx. I'll try the triangulation.

<Xeroine>oh nvm

<Guest8>Are substitutes servers having problems? For past 3 days, `guix pull` keeps failing with "substitute died unexpectedly". Tried 5 different networks.

<Rutherther>I am using ci.guix.gnu.org and bordeaux.guix.gnu.org without any problems

<Guest8>I see.

<Rutherther>is there any work on secure booting guixSD?

<raghavgururajan>As in Full Disk Encryption?

<Rutherther>no, as in secure boot, booting only signed binaries. So for this you need to sign the bootloader as well as each kernel, meaning each guix system reconfigure would have to sign.

<Rutherther>for nixos there is a project called lanzaboote https://github.com/nix-community/lanzaboote, it does basically what I said in my previous message, if someone was curious about an implementation, it's in Nix+bash of course

<raghavgururajan>Sign the bootloader OR sign the grub.cfg and/or vmlinuz?

<Rutherther>everything

<Rutherther>the binaries only though, signing grub.cfg has no effect, it's just what you boot

<Rutherther>it's an uefi feature called "Secure Boot"

<raghavgururajan>Signing grub.cfg is effective. Because you can instruct the bootloader to use only a signed grub.cfg. But the `/boot/grub.cfg has to be inside a LUKS.

<raghavgururajan>I currently use this,

<raghavgururajan> https://libreboot.org/docs/linux/grub_hardening.html

<raghavgururajan>Currently, I use only GRUB password to allow only to boot my Guix System. Booting anything else will require password.

<raghavgururajan>To do signing, it must be done manually after every `guix system reconfigures`.

<Rutherther>okay, my bad, I did not mean to imply it's completely uneffective, I meant for this secure boot feature of uefi

<raghavgururajan>May be we can introduce automatic signing during guix system reconfigures.

<Rutherther>and what exactly does require this password to boot anything else?

<raghavgururajan>For example, you can create custom menu entry to boot only your enceupted OS (Full Disk Encrytion). If a disk is swampped or if tried to USB boot anything else, it requies password.

<Rutherther>but what exactly is requiring this password?

<raghavgururajan>This way, no can boot an arbitary OS and reflash your BIOS.

<raghavgururajan>Oh!

<raghavgururajan>You mean which program asks this password?

<Rutherther>yes

<raghavgururajan>GRUB.

<raghavgururajan>There's GRUB payload in coreboot/libreboot.

<Rutherther>so what prevents booting into something else than grub? that's what secure boot is for, to prevent malicious stuff to run, if your computer got compromised, as an additional layer

<raghavgururajan>If we setup the GRUB hardening in coreboot/libreboot, nothing else can be booted other than what we strictly specify.

<Rutherther>oh, so that's like a replacement of uefi?

<raghavgururajan>Yeah!

<Rutherther>okay, then it makes sense, thanks for being patient with me. Though I don't think I will be able to use that in the recent future. But it sure does sound nice to run a free firmware instead

<raghavgururajan>IIUC, signed boot along with Full Disk Encryption (including /boot | that is, no boot partition unencrypted) isn't possible with current BIOS and/or UEFI. Coreboot happens deals with this.

<raghavgururajan>But I'll read that link you sent. Seems new to me.

<raghavgururajan>It's alright. I was hyperconfused at first as well.

<raghavgururajan>Took me to long time to understand that coreboot (core) is neither BIOS nor UEFI.

<Rutherther>I am currently on NixOS, using this Lanzaboote, and it's true that I have my /boot unecrypted, yeah, I am not sure if that can be changed or not. But no data are there and I don't see any risk in that, since the binaries there have to be signed to boot those. Since I want to now have dual-boot with GuixSD, I will probably have to keep secure boot disabled to boot into it

<raghavgururajan>I see. There was an article on why encrypring /boot is better. I'll let you know if I can find it.

<raghavgururajan>Ah, I think in your situation, you can either install Guix (not Guix System) on NixOS or install Nix (not NixOS) on Guix System via nix-service-type.

<Rutherther>I am currently using Guix on NixOS, yes, but I would like to use the distribution as well to get the whole system managed by it. Maybe I will consider switching from NixOS completely at one point, I will see.

<Franciman>Rutherther: a silly question, why are you using guix on nixOS?

<raghavgururajan>Long ago, someone here had a crazy wish to initialize NixOS and Guix System inside same partition. Because, the most important directory /[gnu/nix]/store doesn't conflict.

<raghavgururajan>s/[gnu/nix]/[gnu|nix]

<raghavgururajan>ACTION is that someone

<Franciman>and how did the experiment go?

<raghavgururajan>But I never tried it.

<raghavgururajan>:P

<raghavgururajan>Now, that I've a spare disk. I might as well try.

<raghavgururajan>There'll be conflict files in /boot /etc I think. Which I'd manully rename.

<Rutherther>Franciman: I mostly wanted to try out how Guix works, see what are the differences from Nix, and figure out which one I like better. I knew about Guix for longer time, but started trying it out just a week ago

<Franciman>makes sense

<Rutherther>raghavgururajan: I don't think there should be conflict in etc. At least for NixOS, it puts the files there each boot, and overrides what was there, if anything. I would suppose GuixSD does the same, but I am not sure.

<raghavgururajan>Good point.

<Rutherther> https://termbin.com/4ahe here is a tree of my /boot. I think some stuff in /boot/loader is just leftovers from previous configurations. But I have not investigated it to see if it's safe to delete them

<Rutherther>btw. I suppose it should be the same on GuixSD, that you can boot into previous generations, or is this different? I couldn't find information about this anywhere

<PotentialUser-55>I am getting this error "

<PotentialUser-55>ice-9/boot-9.scm:1685:16: In procedure raise-exception:

<PotentialUser-55>Git error: the SSL certificate is invalid" when I run "sudo guix system reconfigure /etc/config.scm " Please help.

<raghavgururajan>PotentialUser-55: Could you try `guix pull` and then reconfigure?

<PotentialUser-55>Ok I am doing it.

<PotentialUser-55>I did guix pull but still no change.

<raghavgururajan>Same error you mean?

<PotentialUser-55>I mean this error "ice-9/boot-9.scm:1685:16: In procedure raise-exception:

<PotentialUser-55>Git error: the SSL certificate is invalid

<PotentialUser-55>"

<raghavgururajan>Okay. Is this newly installed system?

<PotentialUser-55>yes. I installed it today.

<raghavgururajan>Could you please share your `/etc/config.scm` with sensitive information redacted?

<raghavgururajan>You shall use paste.debian.net

<PotentialUser-55>Here is the config.scm -- https://paste.debian.net/1326077/

<raghavgururajan>You do have nss-certs in config. Not sure why SSL fails.

<redacted>Is it possible to update only packages that have substitutes? I don't see a flag for that.

<redacted>Sometimes my browser hasn't been built yet, and I'd like to wait for the substitutes instead.

<redacted>(browser being Tor browser or LibreWolf)

<raghavgururajan>redacted: No! But you can check if substitute is available by doing `guix build <package> --dry-run`.

<Rutherther>on the other hand you could downgrade it selectively with inferiors when you know it's happening, and kept the latest commit revision you were on

<Rutherther>raghavgururajan: why shall one use paste.debian.net here? is it bad that I used termbin previously to send stuff here? I like that I can just pipe it out of a terminal

<nigko>PotentialUser-55: As far as I know nss-certs package is now in %base-packages. Probably you should remove it from your list of packages to avoid conflicts which can be the cause of your error.

<raghavgururajan>redacted: If you wanna get an idea about available substitutes, https://guix.gnu.org/manual/en/guix.html#Invoking-guix-weather

<kaij>trying to install guix in a VM using an .iso, but getting "waiting for partition ... to appear" and then eventually get dropped in a guile shell. any clues what the problem might be?

<kaij>seems like it's the partition that's used as root=...

<raghavgururajan>Oh! May be it's not updated in manual yet, that nss-certs is now part of base. https://guix.gnu.org/manual/en/guix.html#X_002e509-Certificates

<nigko>raghavgururajan: It is in the devel manual https://guix.gnu.org/en/manual/devel/en/html_node/X_002e509-Certificates.html

<raghavgururajan>Ah, got it.

<Argyro>Hi, i added a iptables service to my system configuration as described in the manual, but it seems like iptables isn't getting installed.

<Argyro>Like so: https://paste.debian.net/hidden/6d589e9d/

<Argyro>Did i miss something?

<nigko>Argyro: Does iptables (or nftables) present in 'sudo herd status' list of services?

<Argyro>Ohh. Yes, it is!

<Argyro>But its not listed in `guix package --list-installed --profile=/run/current-system/profile` and the `iptables` command isn't available(even as root).

<nigko>Argyro: You can also try commands 'sudo herd status iptables' and 'sudo herd configuration iptables'.

<Argyro>`herd status` says running, `herd configuration` says that the sercive 'iptables' doesn't have an action 'configuration'.

<nigko>Argyro: Yes, iptables package wasn't installed in your system or user profile. It works as a service.

<nigko>Argyro: Well, for nftables command 'sudo herd configuration nftables' returns path to the configuration file in the store.

<Argyro>Ahh, okay. So stuff thats there "as a service" isn't getting installed in the system profile?!

<Argyro>But, then my next question would be how to view the current iptables configuration.

<Rutherther>I am not sure. But have you tried obtaining it in a shell? if it's available on your system, and not just installed to your PATH, there should be no problem with getting it out of a shell

<Rutherther>or alternatively to put it inside the package list on your system

<Argyro>No i haven't. So something like `guix shell iptables -- iptables -L`?!

<Argyro>Ohh, seems to work. Thanks a lot nigko and Rutherther!

<elevenkb>Hello there, how do you add passff for librewolf?

<kaij>is there a good way of mirroring all substitutes? I have a substitute server for my channel, and want to move it to a guix based server. is there some directory I can just copy or some way to make guix pull all substitutes

<nigko>kaij: You can use 'guix publish': https://guix.gnu.org/en/manual/devel/en/html_node/Invoking-guix-publish.html

<kaij>nigko: yeah I do use that, but now want to move to another server (scrapping the one currently hosting substitutes via guix publish), and avoid having to recompile everything.

<nigko>kaij: Sorry, I have misunderstood you.

<nigko>kaij: Did then you tried 'guix copy': https://guix.gnu.org/en/manual/devel/en/html_node/Invoking-guix-copy.html?

<kaij>no, but that seems like a good hint, thanks! I am wondering if there's a way to have guix copy just copy all local derivations / packages 🤔 maybe something is possible looking at it's code

<OnASnoopPhone>Hello! I was thinking about switching to guix as my first fully free distro to replace gentoo when I get a wifi usb dongle or a computer that works with it fully. However, as a gentoo user (a source based distro), I seek the power to freely compile packages using the package manager, set compile flags for them permamently, and even set specific compile flags globally. Is that possible with guix?

<jakiki6>how do I reinstall the bootloader of the running system

<jakiki6>(I need to somehow call install-bootloader)

<jaft_r>jakiki6: what's prompting the need? What changes, in total, are you hoping to make?

<jakiki6>I've had the issue that I damaged my /boot partition a few times and it would be useful to have a way to restore it without having to reconfigure the system.

<jakiki6>I think that exposing the file generated by install-bootloader-program in the system directory would be enough to solve my problem.

<wizard>are there any docs on how to preform unattended installations of the guixsd on new devices?

<wizard>i want a workflow where i can boot into a usb drive or something and then have the system get installed

<wizard>without me having to actually press any keyboard buttons

<tadhg>Is the default option for `--max-jobs` 1?

<duncan>Is there currently a way to populate /boot with kernels and initrd images, for avoiding unlocking the root partition with grub?

<duncan>specifically, I was going to try and hack something together (I find grub is slow, and for my use-case, an unneccessary extra step), but I'm pretty new to guixsd, so there's probably something key I'm missing

<duncan>[=slow at unlocking]

IRC channel logs

2024-08-11.log