Leo Famulari <l...@famulari.name> writes:
> On Mon, Oct 02, 2017 at 06:47:06PM -0400, Maxim Cournoyer wrote:
>> Leo Famulari <l...@famulari.name> writes:
>> > I wonder, are there really that many affected packages?
>>
>> There's a list here:
>> https://github.com/Homebrew/homebrew-core/issues/18044, compiled by one
>> of the homebrew project's maintainers.
>
> I meant, how many Guix packages use the auto-generated GitHub snapshots?
>
> I believe the tell-tale sign is that the download link will have the
> link text 'Source code', as for this release:
>
> https://github.com/libgit2/libgit2/releases/tag/v0.26.0
The following script:
;;; A script to find packages possibly affected by GitHub
;;; infrastructure update that caused minor changes in the
;;; automatically generated tarballs.
(use-modules (ice-9 match)
(gnu packages)
(guix download)
(guix packages))
(define (problematic-uri? uri)
(define (contains-github-archive? uri)
(string-match "github.com/.*/archive/" uri))
;; URI can be a string or a list of string.
(match uri
((uri1 uri2 ...) ;match list of strings
(filter contains-github-archive? uri))
(uri1 ;match string
(contains-github-archive? uri1))))
(define (problematic-github-package? package)
(let ((source (package-source package)))
(and (origin? source)
(eq? (origin-method source) url-fetch)
(problematic-uri? (origin-uri source)))))
(define (problematic-github-packages)
"List of all the potentially problematic GitHub packages."
(fold-packages (lambda (p r)
(if (problematic-github-package? p)
(cons p r)
r))
'()))
(define (main)
"Find and print the names of the potentially problematic GitHub packages."
(let ((packages (problematic-github-packages)))
(format #t "Number of potentially problematic GitHub packages:~a~%"
(length packages))
(for-each (lambda (p)
(format #t "~a~%" (package-name p)))
packages)))
;;; Run the program.
(main)
outputs that there could be up to 1011 affected packages.
The scripts checks for a url-fetch uri of the form
"github.com/.*/archive/", which seems to be the one used for the
dynamically generated archives.
Here are the first 10 lines of the output:
--8<---------------cut here---------------start------------->8---
Number of potentially problematic GitHub packages:1011
fdupes
cbatticon
sedsed
cpulimit
autojump
sudo
thermald
progress
dstat
[...]
--8<---------------cut here---------------end--------------->8---
I've checked the first few with for example:
--8<---------------cut here---------------start------------->8---
guix build --source --no-substitutes sedsed
--8<---------------cut here---------------end--------------->8---
and they were OK though.
Maxim
