If you already have substituted it, you could rebuild it: guix build openssh --no-grafts --check
Le 29 novembre 2023 12:40:50 GMT+01:00, Steve George <st...@futurile.net> a écrit : >Hi, > > > >How can I use 'guix challenge' to test critical software or packages that are >deep in the dependency tree? > > > >As I understand it, the purpose of Guix challenge is to test whether "binaries >provided by this [substitution] server really correspond to the source code it >claims to build" (from the manual). The obvious check then is to build the >package myself locally and then check if the substitution server give the same >result. To do that I do this: > > > >$ guix shell --container --nesting --development cbonsai --network nss-certs >-- \ > > guix build cbonsai --no-substitutes --no-grafts > >$ guix challenge --verbose cbonsai > > > >/gnu/store/mgc2i6yxm2zbqf8yx8x5f4ig4nbii2cv-cbonsai-1.3.1 contents match: > > local hash: 1vws4ywn1gcgpnm1pfr5rz4hv769ccvnyj5drpnnway7bg0ckh28 > > > https://ci.guix.gnu.org/nar/lzip/mgc2i6yxm2zbqf8yx8x5f4ig4nbii2cv-cbonsai-1.3.1: > 1vws4ywn1gcgpnm1pfr5rz4hv769ccvnyj5drpnnway7bg0ckh28 > > > https://bordeaux.guix.gnu.org/nar/lzip/mgc2i6yxm2zbqf8yx8x5f4ig4nbii2cv-cbonsai-1.3.1: > 1vws4ywn1gcgpnm1pfr5rz4hv769ccvnyj5drpnnway7bg0ckh28 > > > >1 store items were analyzed: > > - 1 (100.0%) were identical > > - 0 (0.0%) differed > > - 0 (0.0%) were inconclusive > > > >All good so far. > > > >But, how do I test something that I depend on like OpenSSH? As I'm using it >(and it's critical to my system) I already have it installed locally from the >Substitution servers. Consequently, if I try to build it Guix informs me I >have it already. I can't really remove it from my system, and I don't think >there's a way to build it locally without first removing it. > > > >It seems at this point that I'm stuck. The only form of 'guix challenge' I can >do is to check whether the two Substitutions servers agree - but if I don't >trust the Guix developers this isn't a very good check. > > > >Is there some way to build the package locally (without first removing it)? Or >some clever way to run Guix challenge that I'm not seeing? > > > >Thanks, > > > >Futurile/Steve > >
