civodul
Joined 13 years ago
Karma
254
Submissions
78
Member since
Feb 24
Recent submissions
Comment · 9 months ago
Comment · 9 months ago
On the same topic, check out this how-to on software development with Guix from the Cookbook (author here):
https://guix.gnu.org/cookbook/en/html_node/Software-Developm...
The idea was to show that there are several "levels" to take advantage of Guix for development, where the `guix.scm` file in David Thompson's blog post is the first level.
Comment · 1 year ago
Shameless plug but probably relevant in the context of supply chain security:
https://programming-journal.org/2023/7/1/
Comment · 1 year ago
(Author here.) I'm biased but I do think that the blending between Guix and Shepherd is unique and supports a level of integration beyond what's usually achieved in distros.
The services-in-containers extension you mention is a good example of that: it is implemented on the distro side (in Guix) without any modification to the Shepherd itself. The good thing is that the distro is in a good position to determine how to set up that container since it knows about the package being run, its configuration, and so on.
Comment · 2 years ago
Yes, and it's not an academic exercise: it's being used in Guix (together with related projects such as stage0, M2-Planet, and Gash) to build everything from source starting from a 357-byte program:
https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-...
This gives the level of auditability and transparency that we desperately need.
However, the same problem of "yogurt software" manifests at higher levels of the stack, typically with compilers and build systems, some of which still cannot be built from source (GHC and Bazel come to mind).
Comment · 2 years ago
Shepherd takes a service graph as input. The `herd graph` command gives a GraphViz representation of that graph: https://www.gnu.org/software/shepherd/manual/html_node/Jump-...
Comment · 3 years ago
To be clear, I think Nix (like Guix) signs its pre-built binaries ("substitutes").
However, only Guix has signed commits in its repository (the repo contains package definitions) and a mechanism for secure updates: https://guix.gnu.org/en/blog/2020/securing-updates/
The problem goes well beyond though: as far as I know, Guix is the only project that has a Git repository that users can authenticate when they pull from it.
Comment · 3 years ago
There's nothing to prevent multiple services from using the same port at this stage. For files in /etc, the "etc" service should detect that the same file appears more than once and error out--that is, it won't instantiate a "broken" system.
There are other things that are detected statically and prevent you from instantiating a broken system: missing modules in the initrd, invalid file system label/UUID, references to non-existent Shepherd services, etc. All this is possible because there are well-defined data types and semantics for the different components of the system.
Comment · 3 years ago
The "service" mechanism in Guix System is designed in part as a reaction against those the NixOS module design you're describing: I think the ambient authority, free-style extension mechanism of NixOS modules makes it hard to reason about it (any module can change the config of any other module), and it makes it easy to shoot oneself in the foot (with infinite recursion in particular, as you write).
In Guix System, services extend one another, forming a directed acyclic graph of extensions. When a service extends another service, that connection is explicitly declared, there's no surprise.
To see what it means in practice, check out the Explorer: https://notabug.org/civodul/guix-explorer
Comment · 3 years ago
I believe the use of Guix channels shown in the article is comparable to Flakes.
Comment · 3 years ago
Good point. It's telling that many Nix vs. Guix discussions focus on three topics: DSL, popularity, and non-free packages. Few people talk about package quality control even though it's rather crucial for day-to-day use.
A while back I wrote about what it means to package something like PyTorch with the kind of quality control Guix has: https://hpc.guix.info/blog/2021/09/whats-in-a-package/
Comment · 3 years ago
One thing that's often overlooked with Nix (the language) is that it does not let you define new data types. For example, there's no "package" type in Nix and Nixpkgs; instead there are only functions that are passed "attribute sets" (key/value dictionaries).
That Nix can't tell what's a package and what's not is a hindrance for its user interface (e.g., it's hard to look up packages by name/version or to iterate over them) and for packagers (e.g., easy to end up with package definitions that don't follow the informal "schema").
Comment · 3 years ago
Well, with more than 23K packages, it's fair to say that Guix can satisfy the needs of many people, too. A lot of programming languages are pretty well represented!
Comment · 4 years ago
Guix channels (not to be confused with Nix channels) let you turn a Git repo into a package collection:
https://guix.gnu.org/manual/devel/en/html_node/Channels.html
I guess it serves some of the same purposes as Flakes, and it comes with other bells and whistles such as authentication (which I think is kinda important!).
For the rest, your description of Guix is largely incorrect ("has none of that", "you have to roll back the complete Guix system", etc.), but as a Guix hacker I'd be interested in better understanding your experience and perceptions if you'd like to get in touch with us on the mailing lists!
https://guix.gnu.org/manual/devel/en/html_node/Hardware-Cons...
Unfortunately, it's hard to be sure when you buy a WiFi device whether it has the right chipset. Also, most laptops come with Intel WiFi, and that requires non-free firmware.