IRC channel logs
2026-10-21.log
back to list of logs
<Heterochromium>Is running `guix system reconfigure <current config>` sufficient to protect me from those compromised certs? <flurando>hi, is there any way to --allow-downgrade for guix deploy? I some how messed things up and now guix kept saying my channel is not a descendant of commit blablabla. I need to enforce a <lechner>flurando: I have (allow-downgrades? #t) in my machine.scm. <flurando>lether: thanks, I was only looking at command-line options, thus missing this. <stephen>you could just have a newer root pull than user pull or neweer user than root. That will happen if you sudo guix pull vs sudo -i guix pull when you're used to using the one but not the other. <cnx>as mentioned in the linked issue, it was very late on hako's side of the world <mra>hako: quick update on the ZFS install. I thought I'd try installing on my PC, but I can't boot into the installer on physical hardware. I get an error: "init[1]: segfault at 3fff00" <mra>I meam I'm no expert but that seems bad to me <cnx>captain tis thursday <olivial>hmm... the 'guix import crate' tool only works on things from crates.io? there's no way to apply it to a cargo manifest from a git repo? <efraim>olivial: there's also the --lockfile flag to import from an existing (or just created) Cargo.lock file <olivial>that still needs the package to be on crates.io in order to get the metadata though, right? <olivial>ACTION wonders how hard it would be to teach the importer about Cargo.toml <jlicht>olivial: afaik you can "just" use it with local (e.g. your own) stuff <stephen>Offloading builds is awesome. But does that use the local channels and just move compilation to that system? <dariqq>any java exports know if there is an alternatice to keytool for producing a cert bundle in the java format? I know trust from p11-kit can but i first need to add the certs to it which fails due to readonly store <untrusem>also made a pr for php update, someone with a faster machine plz build it <aldum>dariqq: I used KSE back in the day <dariqq>my issue is that i want it not to be in java because I want to avoid depending on an arbitry jdk just for certs <aldum>ok, do you need a java keystore or not? <dariqq>yes, I want to remove the java keystore from the guix jdks into a separate package to be able to update the certs without rebuilding java. So what java do I use to just prepare the certs? <dlowe>ACTION hitting refresh to see when the php version goes up. <untrusem>btw what's the merge policy for this, we wait for a week or two but in security incidents I guess we can merge asap <lechner>It's ASAP if the fix is clear, but with a consideration for rebuilds or grafts. Probably best to have the security team sign off. <user176462>Hello! I am looking to define a package for which I have written a pkcs11 module file. In my package definition this file is installed in /share/p11-kit/modules directory, as this seems to be the place where other packages also install their module files (gnome-keyring, p11-kit-trust). However, `p11-kit list-modules` only lists p11-kit-trust as a module and neither gnome-keyring nor my package. <user176462>Does anyone have an idea as to why p11-kit does not load this module? <user176462>It seems that in p11-kit definition, the variable P11_MODULE_PATH is defined pointing to share/p11-kit/modules. However, it does not seem to have any effect in this case? <dariqq>user176462: You need p11-kit and your package in the same profile <user176462>Ok I will try adding it to my system profile if it works. Thank you <user176462>Hmm. Even with p11-kit in the same profile it does not seem to find the modules <dariqq>can you try guix shell p11-kit your-package and see if the environment variable gets set? <user176462>The environment variable is set both in a shell and in my system. But p11-kit list-modules does still not find the module not even in a guix shell <dariqq>i guess then something in P11-kit does not work as expected <untrusem>hi hako, could you if disabling those tests work on zfs? <csantosb>untrusem: See recent "nss-certs: Graft". <csantosb>In commit 7608a9954a7ba0a9ce756bf3135dc0ba51a40af9 <untrusem>csantosb: what should i see in that commit? <bavier>would love to figure our why my package updates routinely need to substitute 868MiB of qtdeclarative-debug every time. <Rutherther>and gc will remove it, making you redownload it again <csantosb>untrusem: with respect to the merge policy with security related changes <untrusem>?? was this the answer to my, "btw what's the merge policy for this, we wait for a week or two but in security incidents I guess we can merge asap" question <untrusem>because I don't have anything to do with that commit :?? <bavier>ieure: grafts doesn't make sense to me. the debug output would need to be in my manifest graph somewhere, right? <Rutherther>grafts take effect on whole package, not per output, so they need all outputs of the package <ieure>I agree that this is not ideal and could perhaps be improved. <Rutherther>it definitely should be improved, I think there were some PRs, but they broke some stuff <ieure>untrusem, Yep. Saw the PR banning LLM changes and have been thinking about contributing again, but October is an extremely busy month for me. <ieure>My oldest kid's birthday is at the start of the month, mine's at the end, and I spend a week volunteering for a retro gaming expo in between. Crammed a weekend trip with some friends in also. <ieure>I didn't, I unsubscribed from the lists. <j_importer>i really should start contributing, but i keep getting sidetracked and haven't spent much time poking around with guix :/ <j_importer>i made the foolish mistake of saying "i'll try learning guix *and* a new WM at the same time" <bavier>untrusem: congrats on committer! <untrusem>bavier: thanks, its quite a responsibility <dlowe>it doesn't look like it's happened yet? <dlowe>oh, made a committer, I get it. Grats <Noisytoot>I'm trying to generate a dependency graph for gajim with "guix graph gajim | dot -Tsvg > gajim.svg" and dot is just hanging forever <Noisytoot>strace shows that it's frozen on a brk syscall <ieure>Noisytoot, It's because the graph is extremely large. <ieure>Noisytoot, Try running `guix graph gajim > gajim.dot && ls -lh gajim.dot', it's probably hundreds of megs. <ieure>IMO the `guix graph' feature is not very useful. <ieure>That is still large for a dot graph. <ryanprior>large graphs are brutally challenging to represent in humane ways <ryanprior>the best answer I know is to put a strict cap on how large of a graph you will show, which means grouping nodes based on rules and heuristics, and presumably providing some sort of interactive or iterative explanation of those groups