IRC channel logs

<aloys>I wrote a short article about packaging a binary in Guix. It's mostly paraphrasing the documentation, but it might be useful for someone here. https://aloysberger.com/posts/guix-packaging-a-binary-as-a-guix-beginner.html

<aloys>the end goal is to write a caddy-service for my VPS. There is nothing ground breaking, mostly documenting my learning journey.

<ryanprior>aloys: nice work, thank you for sharing. "just shove a binary into the store" is good enough for a lot of things.

<ryanprior>My golang white whale is hugo, the static site generator. I spent like 200 hours working towards packaging it, and I know of at least two further efforts towards packaging hugo, and as far as I know it's still not close. Looking at Caddy's go.mod reminds me of that. (~150 transitive deps)

<ryanprior>it would be great to have a caddy service, though. traefik too (~400 transitive deps)

<ElephantErgo>Hey everyone, I had two questions I thought I'd hit y'all with 🙂

<ElephantErgo>The first one is kinda meta

<ElephantErgo>Does Guix have a mailing list for help/support/questions? If there is, what sort of questions would I maybe wanna send there vs here? I've never posted to a mailing list before, but I'd be pretty excited to try it out 🙂

<ElephantErgo>My other question is how you all would recommend I go about setting up TLS for deploying a Mumble service? I see that there's a Deploy Hook for CertBot, and I was thinking I could reuse my existing domain's certs for Mumble, if that makes sense to do? My thought was maybe I could use a Deploy Hook to change the group of the cert files to something my Mumble service user could access

<ElephantErgo>I'm a bit fuzzy on how TLS works, so I'm not sure what best approach and practice is. I'm also hoping I could maybe be pointed in a direction for some Gexp or Derivation related resources so I can understand how to write said Deploy Hook? I'd really love to understand how all that works a bit better, and it's currently a bit over my head

<ElephantErgo>I'm playing with iterating on some sort of PubNix style hosting over Guix, with Mumble being the first service I'm playing with. Exciting experiments ahead 😊

<maplebaguette>Is there an official guix binary that does not have the substitute vulnerability?

<pfc>what's that?

<Sneed1911>Are you referring to an ISO?

<maplebaguette>No sorry, I mean a pre-built binary of the guix package manager. It's my impression that the latest one on the guix site (built on june 16th) would be vulnerable to the recent CVE guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/. Is that true? I'm just having trouble guix pulling without substitutes

<pfc>I thought these were patched

<pfc>no?

<pfc>oh, I got what you mean now

<ElephantErgo>maplebaguette: The builds at https://guix.gnu.org/en/download/latest/ are from CI, so they're gonna have the patch on them 🙂

<maplebaguette>ElephantErgo: Thanks for the reply. Correct me if I'm wrong, but it looks like the latest build (https://ci.guix.gnu.org/build/22819790/details)? is from june 16th, whereas the fixes were merged on july 2nd, so I believe that the latest binary is still vulnerable.

<maplebaguette>I think I answered my own question😅, it appears the answer for now is 'no'

<ElephantErgo>maplebaguette: Shoot, excellent catch! 😯 I misread the build date, I thought it said July 16th. That will still be vulnerable, yea

<aloys>ElephantErgo: my bouncer is playing up, has someone replied to your question? There are mailing lists, yes: https://guix.gnu.org/en/contact/

<ElephantErgo>aloys: Hey there! I didn't get any replies yet, but no worries! Gosh, I'm really looking forward to setting up a bouncer for myself soon, that'll make things a lot easier 😅

<ElephantErgo>So What sort of things would you say generally garner a mail on the Help list instead of posts in here? 🤔

<Guest42>is there some way to change the substitute servers used during installation?

<dcunit3d>is this a good basis for pathing to flat files in a guix channel? `(define %mychannel-root (getcwd))`

<human_equivalent>Might have found something, but I don't have time to look at it closer now; downloading from https://ftpmirror.gnu.org/gnu/parallel/parallel-20260622.tar.bz2 ... // sha256 hash mismatch for /gnu/store/z5dpm70v2mx1sr48qlkk9f17cwq9sbwd-parallel-20260622.tar.bz2: // expected hash: 0rd8avxkxp0rwiyjr106iy2f2mvbqa83s52yq2ba9w59j9np1nxw // actual hash: 0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73

<human_equivalent>// hash mismatch for store item '/gnu/store/z5dpm70v2mx1sr48qlkk9f17cwq9sbwd-parallel-20260622.tar.bz2', on commit cc1ac88f80cdcff15ce0d6030ea5da3c59d6e27b with local changes to libappindicator and libdbusmenu for the move from bzr for those packages.

<human_equivalent>reconfigure without substitutes isn't easy. :)

<dcunit3d>it can depend on several things, like what your channels look like

<dcunit3d>whether you can reboot, etc

<dcunit3d>if you have a local substitute server, that can help. bc (i think) the build mainly happens on the server that's deploying TO, not the server that's receiving. but idk

<dcunit3d>if you look at the options for guix gc, there are options that verify the store, but you have to read through them carefully

<gabber>What's up with patches and registering them. I *guess* we'd register all patches introduced in gnu/packages/patches, right? I seem unable to find relevant documentation, but since I stumbled more-often-than-not over gnu/local.mk and registering patches..... Is it possible we don't register all of these files?

<gabber>I have to admit I don't really understand why this is necessary/what this is for

<dcunit3d>gabber: do you have a PR?

<gabber>i am editing 5240 to push it on master. had to split the commit (and i think i ought to register the patch, right?)

<dcunit3d>nice, for flipper? i've never seen one

<dcunit3d>but that's cool. idk about patches

<gabber>dcunit3d: thanks nevertheless (: yes, that's for Flipper Zero

<dcunit3d>does it build alright? i'm particularly interested in being able to build firmwares and iot images

<gabber>it does

<dcunit3d>although i guess this is slightly adjacent to that

<gabber>and it seemingly works (as reported by user bjc).

<gabber>well, it *is* a firmware flashing tool

<dcunit3d>and also fuzzing. i think there's a possibility for a build system that creates a harness for fuzzing packages

<dcunit3d>the axoloti and ksoloti packages are kinda what i'm talking about. kinda

<dcunit3d>for firmware/iot anyways

<bjc>i'm using the flipper from that pr right now, and have been for some weeks

<bjc>no issues

<gabber>i figure local.mk is an automake thing? though the references in that manual are scarce

<joe>Hi Guix, after having learnt quite a lot these days on package definitions, I am improving a Guile CLI package of mine (more to come). I would really appreciate a review (diff should help) as I am still a beginner and had to do some binary substitutions and build time Guix magic. I also have some questions on shell completions and if they get loaded properly: https://codeberg.org/jjba23/maak/pulls/16/files

<joe>csantosb: special thanks to you for all the csantosb

<zebragnuzza>Hi, I have had this error everytime I run this command. It only happens when I invoke root with sudo or doas. Kitty is installed globally in my /etc/config.scm. https://paste.centos.org/view/248e7fb8

<zebragnuzza>I have also made a pkg definition for cpufetch. https://codeberg.org/gnufairy/General-Dotfiles/src/branch/main/Guix/the-cpufetch.scm.

<ieure>zebragnuzza, sudo/doas are messing up the graphical environment, which is making Emacs fall back to terminal mode, but there's no terminfo entry for the value of $TERM.

<ieure>zebragnuzza, You have a few options, but the best one is to stop using the root-owned /etc/config.scm and put it in a Git repo owned by your user. root-owned /etc/config.scm is a convention the installer uses, but the system config file can be anywhere and owned by anyone.

<zebragnuzza>Oh, I did not know that. Thanks!

<ieure>Less good options: Try setting $TERM to something else ("vt220" would probably work). Run Emacs as a user and use Tramp's sudo method to elevate privileges and edit the file that way.

<zebragnuzza>I think I will move it a user-owned file

<ieure>This is IMO the best. And put it in Git.

<steven0351>I'm playing around with the --emulate-fhs flag in guix shell, and i'm finding that my gcc build is still linking to paths in /gnu/store as opposed to /lib. When I do `ldconfig -p`, it shows duplicate entries for the libraries that point to their location in /lib and /gnu/store, not sure if that is by design or if I've got something wonky going on

<ryanprior>steven0351: that sounds expected to me. `--emulate-fhs` does not deeply change how all the tools work to prefer fhs, it adds symlinks from fhs locations into the store.

<fhang>Hello all, is it possible to use `sha512` hashes in the `source` of a package definition? All I get when replacing `sha256` with `sha512` is: "warning: extraneous field initializers (sha512)".

<steven0351>ryanprior: that makes sense, I think I was looking at it being able to use it as a way to build an FHS compatible binary vs using it to run something that _expects_ an FHS environment

<ieure>fhang, No, the origin record only has a field for the sha256. The error you're getting is telling you that there is no sha512 field.

<fhang>ieure: Ah, I see. Good to know.

<postroutine>Hello. After the latest guix-daemon vulnerabilities, I've done an upgrade of it with a `sudo --login guix pull --no-substitutes` and restarted the guix-daemon. (I'm on a foreign distribution). But, after the upgrade, I run the script that test the vulnerabilities of guix-daemon and I still have one. Apparently.

<postroutine>The script I used is the one shared here: https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/

<postroutine>When I run `sudo guix repl -- guix-substitute-and-pull-vuln-check.scm`, it say that I'm not vulnerable to `restore-file`, `fetch-narinfos` but that I'm vulnerable to `file-uris`.

<postroutine>Also, I get an error to the test `cache-key`, but a discussion is already in progress on the help-guix mailing list.

<postroutine>If I run the script without `sudo`, all test result in an error except `file-uris`, who say "not vulnerable" in this case.

<postroutine>Does that mean guix-daemon is still vulnerable, even after the update ?

<postroutine>(Current version of guix: 51f7af3)

<ryanprior>steven0351: I think it would be really cool to create a tool that does what you thought `emulate-fhs` did. eg I'd love to be able to build a Debian base image totally from sources using Guix, and not have it be Guix-System-emulating-Debian-with-symlinks. like debootstrap, but building packages using Guix instead of downloading them from repositories.

<fhang>postroutine: Have you tried the good ol' system reboot?

<postroutine>fhang, not yet.

IRC channel logs

2026-07-16.log