On Wed, 16 Jan 2019, Gábor Boskovits wrote:
Hello Jack,
you could also try to make sense of the individual profile generation
manifests.
The union of those should give a farily comprehensive list, and it comes with
versions.
Yes, this looks pretty good, thanks. I think that this gets me all the
surface packages exposed in all the profiles. However, I believe that it
is still missing the packages installed as dependencies.
One thought is to drop back to manipulating store objects. I can get a
list of references using query-path-info from the guix store module, and
recurse down those references to build the graph. In the end I have to
then guess the package names and versions from the store paths.
From my experimentation, it seems that store paths/objects are really what
Guix works with and is aware of, and not package names and version that
are reported as what's installed on traditional distributions. Perhaps I
can convince our security office to be happy with store paths.
Thoughts?
Jack
