Leo Famulari <l...@famulari.name> writes:
> On Sun, Jun 18, 2017 at 11:38:45AM +0200, Ricardo Wurmus wrote:
>>
>> Ludovic Courtès <l...@gnu.org> writes:
>>
>> > BTW, should --only-substitutes filter out packages without a substitute,
>> > or should it simply stop and report the list of missing substitutes
>> > (after which the user could use --do-not-upgrade)?
>
> I like making it return a list on stdout so it can be composed as
> suggested.
While the user experience would suffer a bit, it’s no real hardship to
type
$ guix package \
--do-not-upgrade $(guix package --only-substitutes -u) \
-u
This is definitely possible.
>> In my opinion “--only-substitutes” should stop and report a list.
>> If it continued without complaining there could be problems:
>>
>> * partial upgrades could leave the profile in an unusable state
Maybe I don’t understand Guix that well yet, but I don’t think this is
possible. At least I don’t understand how it would happen. Under the
hood, the “--only-substitutes” flag would basically just be an
intelligent “--do-not-upgrade” flag. Can I ruin my profile by misusing
“--do-not-upgrade”?
>> * an attacker could use this to trick a user into thinking that they
>> have all available updates
I can always run
$ guix package -n -u
to learn what packages are out of date. (Except if I get frustrated by
the fact that Guix is building a package to check if is different from
an installed package and mash C-c C-c. :)) Also, my original
implementation
added a “the following packages will be excluded” line, that let the
user know which packages are being omitted from the upgrade. This will
be harder to do with Ludo’s suggestion, though.
>> On the other hand, it would make “--only-substitutes” less usable,
>> because to actually perform work one would have to deal with the failure
>> case.
>>
>> I suppose it could download the substitutes but not build a new profile
>> and report an error at that point.
>
> Perhaps there could be an additional flag --partial-upgrade to make it
> build a new profile.
>
> I understand why people want --only-substitutes but I'm a bit wary of it
> for the reasons you gave, and I think we should solve their complaint by
> improving our build infrastructure.
I agree wholeheartedly with improving the build infrastructure! I’m just
less certain about how I could help with that…. In the short term, this
is my way of working around the infrastructure issues.
-- Tim
