GuixSD Success with grub-efi
I just successfully installed guixsd 0.13.0 with efi on a new HP laptop. I found the manual to be somewhat lacking with specific details on exactly how to accomplish this. I've added to my todo list to post more details here. I also had to disable secure boot (for obvious(?) and annoying reasons) for the laptop to actually boot, but that is a rant for a different audience. ;) Thanks to all who helped make this possible! -- James Richardson signature.asc Description: PGP signature
"your installation is old" when running via a git checkout
Hi! I've done this hack so I can run the Guix I'm hacking on from git as I know some others are as well: ln -s ~/devel/guix ~/.config/guix/latest However, I am getting: guix package: warning: Your Guix installation is 233 days old It looks like it's looking at the age of the "latest" directory, which wouldn't be useful information since I've symlinked it intentionally. I wonder if there's a way to turn this off for people who have intentionally symlinked guix to their git checkout?
Re: Switching to Artifex Ghostscript
On Tue, May 23, 2017 at 10:42:45PM +0200, Ludovic Courtès wrote: > Ricardo Wurmus skribis: > > Marius Bakke writes: > >> Leo Famulari writes: > >>> Both programs are distributed under the AGPL, as far as I can tell. But > >>> Artifex Ghostscript is actively developed, which I think is very > >>> important for C software that is designed to handle untrusted input. > >> > >> Thanks for bringing this up. GNU Ghostscript seemed to go > >> mostly-inactive[0] after Artifex changed to AGPL in 2013[1]. The latest > >> "upstream" release is 9.21[2], we have 9.14.0 (from 2014!). > >> > >> I'm in favor of switching to the active fork. > > > > Me too. In fact, I once tried to package Artifex Ghostscript, but > > failed in the attempt to unbundle libraries. > > Ditto. In the discussion you mentioned above, Didier Link of > GNU Ghostscript did not really address our concerns. Here are patches that allow you build groff, cairo, and cups with the Artifex Ghostscript. I didn't take the step of replacing the GNU Ghostscript yet. From da63a583441ac70adea4f6668f0fd7a8424991c2 Mon Sep 17 00:00:00 2001 From: Leo Famulari Date: Mon, 29 May 2017 13:47:39 -0400 Subject: [PATCH 1/3] gnu: Add Artifex Ghostscript. * gnu/packages/ghostscript.scm (artifex-ghostscript): New variable. * gnu/packages/patches/artifex-ghostscript-runpath.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. --- gnu/local.mk | 1 + gnu/packages/ghostscript.scm | 100 + .../patches/artifex-ghostscript-runpath.patch | 18 3 files changed, 119 insertions(+) create mode 100644 gnu/packages/patches/artifex-ghostscript-runpath.patch diff --git a/gnu/local.mk b/gnu/local.mk index e811e9a0b..283cae208 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -504,6 +504,7 @@ dist_patch_DATA = \ %D%/packages/patches/antiword-CVE-2014-8123.patch\ %D%/packages/patches/apr-skip-getservbyname-test.patch \ %D%/packages/patches/artanis-fix-Makefile.in.patch \ + %D%/packages/patches/artifex-ghostscript-runpath.patch \ %D%/packages/patches/aspell-default-dict-dir.patch \ %D%/packages/patches/ath9k-htc-firmware-binutils.patch \ %D%/packages/patches/ath9k-htc-firmware-gcc.patch\ diff --git a/gnu/packages/ghostscript.scm b/gnu/packages/ghostscript.scm index 1cb651c96..f0d96bb31 100644 --- a/gnu/packages/ghostscript.scm +++ b/gnu/packages/ghostscript.scm @@ -24,6 +24,7 @@ (define-module (gnu packages ghostscript) #:use-module (gnu packages) #:use-module (gnu packages autotools) + #:use-module (gnu packages base) #:use-module (gnu packages compression) #:use-module (gnu packages fontutils) #:use-module (gnu packages image) @@ -31,6 +32,8 @@ #:use-module (gnu packages pkg-config) #:use-module (gnu packages python) #:use-module (gnu packages tcl) + #:use-module (gnu packages tls) + #:use-module (gnu packages xml) #:use-module (gnu packages xorg) #:use-module ((guix licenses) #:prefix license:) #:use-module (guix packages) @@ -127,6 +130,103 @@ printing, and psresize, for adjusting page sizes.") "See LICENSE in the distribution.")) (home-page "http://knackered.org/angus/psutils/";))) +(define-public artifex-ghostscript + (package +(name "artifex-ghostscript") +(version "9.21") +(source + (origin +(method url-fetch) +(uri (string-append "https://github.com/ArtifexSoftware/"; +"ghostpdl-downloads/releases/download/gs" +(string-delete #\. version) +"/ghostscript-" version ".tar.xz")) +(sha256 + (base32 + "0lyhjcrkmd5fcmh8h56bs4xr9k4jasmikv5vsix1hd4ai0ad1q9b")) +(patches (search-patches "artifex-ghostscript-runpath.patch" + ;; TODO: + ;;"ghostscript-CVE-2017-8291.patch" + )) +(modules '((guix build utils))) +(snippet + ;; Remove bundled libraries. + ;; TODO Try unbundling ijs, which is developed alongside Ghostscript. + '(begin +(for-each delete-file-recursively '("freetype" "jbig2dec" "jpeg" +"lcms2" "libpng" +;;"openjpeg" ; Patched fork. +"tiff" "zlib")) +(build-system gnu-build-system) +(outputs '("out" "doc")) ;19 MiB of HTML/PS doc + examples +(arguments + `(#:disallowed-references ("doc") + #:configure-flags + (list "--with-system-libtiff" + "LIBS=-lz" + (string-append "ZLIBDIR=" +(assoc-ref %build-inputs "zlib") "/include") + "--
Re: Switching to Artifex Ghostscript
On Mon, May 29, 2017 at 01:50:13PM -0400, Leo Famulari wrote: > Subject: [PATCH 1/3] gnu: Add Artifex Ghostscript. > > * gnu/packages/ghostscript.scm (artifex-ghostscript): New variable. > * gnu/packages/patches/artifex-ghostscript-runpath.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > @@ -24,6 +24,7 @@ > (define-module (gnu packages ghostscript) >#:use-module (gnu packages) >#:use-module (gnu packages autotools) > + #:use-module (gnu packages base) >#:use-module (gnu packages compression) >#:use-module (gnu packages fontutils) >#:use-module (gnu packages image) > @@ -31,6 +32,8 @@ >#:use-module (gnu packages pkg-config) >#:use-module (gnu packages python) >#:use-module (gnu packages tcl) > + #:use-module (gnu packages tls) > + #:use-module (gnu packages xml) >#:use-module (gnu packages xorg) >#:use-module ((guix licenses) #:prefix license:) >#:use-module (guix packages) Oops, this hunk is unecessary. It may be possible to add some functionality by linking with libraries from these modules, but I'd rather try to keep feature parity for the initial change to this new source. signature.asc Description: PGP signature
Re: Switching to Artifex Ghostscript
Leo Famulari writes: > Here are patches that allow you build groff, cairo, and cups with the > Artifex Ghostscript. Woo! > +(patches (search-patches "artifex-ghostscript-runpath.patch" > + ;; TODO: > + ;;"ghostscript-CVE-2017-8291.patch" > + )) What’s up with this? Is the latest release of Artifex Ghostscript vulnerable? > +(modules '((guix build utils))) > +(snippet > + ;; Remove bundled libraries. > + ;; TODO Try unbundling ijs, which is developed alongside > Ghostscript. > + '(begin > +(for-each delete-file-recursively '("freetype" "jbig2dec" "jpeg" > +"lcms2" "libpng" > +;;"openjpeg" ; Patched fork. > +"tiff" "zlib")) Excellent! > + (replace 'build > + (lambda _ > + ;; Build 'libgs.so', but don't build the statically-linked 'gs' > + ;; binary (saves 22 MiB). > + (zero? (system* "make" "so" "-j" > + (number->string > (parallel-job-count)) Couldn’t we just add “#:make-flags '("so")” and avoid replacing the build phase? > From 8ee8b63f35909ca1b9cfd89552f08e22f28b5d10 Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Mon, 29 May 2017 04:42:37 -0400 > Subject: [PATCH 2/3] gnu: ijs: Use modify-phases syntax. > > * gnu/packages/ghostscript.scm (ijs)[arguments]: Use modify-phases. OK! > From 35a515a7d2bbd95a45fde81b31201bd48a7e7588 Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Mon, 29 May 2017 04:43:21 -0400 > Subject: [PATCH 3/3] gnu: ijs: Update to 9.21.0 and switch to Artifex > Ghostscript source. > > * gnu/packages/ghostscript.scm (ijs): Update to 9.21.0. > [source, version, home-page]: Inherit from artifex-ghostscript. > --- LGTM! Thank you! -- Ricardo GPG: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC https://elephly.net
Re: GuixSD Success with grub-efi
Interesting, that would surely be something useful to document. I wonder if it's possible to use GuixSD with Secure Boot. Remember, however, that we should embrace Secure Boot and reject Restricted Boot ([[https://media.libreplanet.org/u/libby/m/embracing-secure-boot-and-rejecting-restricted-boot-matthew-garrett/]]). The reference given show that they're different concepts for free/libre software activists. Secure Boot allows the user to manage the keys, while Restricted Boot doesn't allow that. So the difference isn't a matter of having an "on-off" switch. One thing sounds odd, though: When you say you had to disable Secure Boot, did you mean that you had to disable it before installing GuixSD, and then enable Secure Boot after instalation in order for you to use GuixSD with it? Or did you keep it disabled even after instalation? -- - [[https://libreplanet.org/wiki/User:Adfeno]] - Palestrante e consultor sobre /software/ livre (não confundir com gratis). - "WhatsApp"? Ele não é livre, por isso não uso. Iguais a ele prefiro GNU Ring, ou Tox. Quer outras formas de contato? Adicione o vCard que está no endereço acima aos teus contatos. - Pretende me enviar arquivos .doc, .ppt, .cdr, ou .mp3? OK, eu aceito, mas não repasso. Entrego apenas em formatos favoráveis ao /software/ livre. Favor entrar em contato em caso de dúvida.
Re: Switching to Artifex Ghostscript
On Mon, May 29, 2017 at 08:38:58PM +0200, Ricardo Wurmus wrote: > > Leo Famulari writes: > > > Here are patches that allow you build groff, cairo, and cups with the > > Artifex Ghostscript. > > Woo! I'm not sure what I was thinking... I forgot to actually make groff, cairo, and cups use this artifex-ghostscript :p Testing now... > > +(patches (search-patches "artifex-ghostscript-runpath.patch" > > + ;; TODO: > > + ;;"ghostscript-CVE-2017-8291.patch" > > + )) > > What’s up with this? Is the latest release of Artifex Ghostscript > vulnerable? Yes, it's vulnerable. I saw this fixed in the Arch Linux package, but I didn't check yet if there are other important bugs to fix in Ghostscript 9.21. > Couldn’t we just add “#:make-flags '("so")” and avoid replacing the > build phase? I'll try this. signature.asc Description: PGP signature
Re: "your installation is old" when running via a git checkout
On 05/29/2017 at 10:20 Christopher Allan Webber writes: > Hi! I've done this hack so I can run the Guix I'm hacking on from git > as I know some others are as well: > > ln -s ~/devel/guix ~/.config/guix/latest > > However, I am getting: > > guix package: warning: Your Guix installation is 233 days old > > It looks like it's looking at the age of the "latest" directory, which > wouldn't be useful information since I've symlinked it intentionally. > > I wonder if there's a way to turn this off for people who have > intentionally symlinked guix to their git checkout? AIUI, the warning is based on the date of the ~/.config/guix/latest link but FWIW I just refresh the links like this periodically ... ln -f -s -T ~/src/guix/ ~/.config/guix/latest sudo ln -f -s -T ~/src/guix/ /root/.config/guix/latest HTH - George Note: GUIX_DISTRO_AGE_WARNING as described below was implemented by commit 7fd952e05203d975fcb6cdabd2f742ade1b31b66 *** From: l...@gnu.org (Ludovic Courtès) Subject: bug#25852: Users not updating their installations of Guix To: Ricardo Wurmus Cc: 25852-d...@debbugs.gnu.org, myglc2 Date: Fri, 12 May 2017 10:29:12 +0200 (2 weeks, 3 days, 13 hours ago) Resent-From: l...@gnu.org (Ludovic Courtès) Ricardo Wurmus skribis: > Ludovic Courtès writes: > >> myglc2 skribis: >> >>> How about extending this ... >>> + (warning (G_ "Your Guix installation is getting old. Consider +running 'guix pull' followed by '~a' to get up-to-date +packages and security updates.\n") >>> >>> ... to inform the user how old the installation is? >> >> Good idea. I did that and pushed as >> 7fd952e05203d975fcb6cdabd2f742ade1b31b66. > > Does this do the right thing when .config/guix/latest points at a git > checkout? No it doesn’t, but I would argue that it unsupported. ;-) > The mtime of the “.config/guix/latest” link on one of my machines is > from 2016, so Guix says it is too old, but it points to a git > checkout, which is recent. I would suggest: export GUIX_DISTRO_AGE_WARNING=1000m as a workaround. WDYT? Thanks, Ludo’.
Re: Switching to Artifex Ghostscript
On Mon, May 29, 2017 at 08:38:58PM +0200, Ricardo Wurmus wrote: > Leo Famulari writes: > > > Here are patches that allow you build groff, cairo, and cups with the > > Artifex Ghostscript. > > Woo! Actually tested and it works! > > +(patches (search-patches "artifex-ghostscript-runpath.patch" > > + ;; TODO: > > + ;;"ghostscript-CVE-2017-8291.patch" > > + )) > > What’s up with this? Is the latest release of Artifex Ghostscript > vulnerable? I added this patch in v2 of the patch series (attached). > > + (replace 'build > > + (lambda _ > > + ;; Build 'libgs.so', but don't build the statically-linked > > 'gs' > > + ;; binary (saves 22 MiB). > > + (zero? (system* "make" "so" "-j" > > + (number->string > > (parallel-job-count)) > > Couldn’t we just add “#:make-flags '("so")” and avoid replacing the > build phase? It seems to work. How should we make this transition? Should we add Artifex Ghostscript and transition packages over to it, wait for the next core-updates, or something else? From 6983f3795b6f9143aac8431ffe204ad7ae28cdec Mon Sep 17 00:00:00 2001 From: Leo Famulari Date: Mon, 29 May 2017 13:47:39 -0400 Subject: [v2 1/4] gnu: Add Artifex Ghostscript. * gnu/packages/ghostscript.scm (artifex-ghostscript): New variable. * gnu/packages/patches/artifex-ghostscript-CVE-2017-8291.patch, gnu/packages/patches/artifex-ghostscript-runpath.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. --- gnu/local.mk | 2 + gnu/packages/ghostscript.scm | 90 ++ .../artifex-ghostscript-CVE-2017-8291.patch| 195 + .../patches/artifex-ghostscript-runpath.patch | 18 ++ 4 files changed, 305 insertions(+) create mode 100644 gnu/packages/patches/artifex-ghostscript-CVE-2017-8291.patch create mode 100644 gnu/packages/patches/artifex-ghostscript-runpath.patch diff --git a/gnu/local.mk b/gnu/local.mk index e811e9a0b..c11010aac 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -504,6 +504,8 @@ dist_patch_DATA = \ %D%/packages/patches/antiword-CVE-2014-8123.patch\ %D%/packages/patches/apr-skip-getservbyname-test.patch \ %D%/packages/patches/artanis-fix-Makefile.in.patch \ + %D%/packages/patches/artifex-ghostscript-runpath.patch \ + %D%/packages/patches/artifex-ghostscript-CVE-2017-8291.patch \ %D%/packages/patches/aspell-default-dict-dir.patch \ %D%/packages/patches/ath9k-htc-firmware-binutils.patch \ %D%/packages/patches/ath9k-htc-firmware-gcc.patch\ diff --git a/gnu/packages/ghostscript.scm b/gnu/packages/ghostscript.scm index 1cb651c96..7fe630443 100644 --- a/gnu/packages/ghostscript.scm +++ b/gnu/packages/ghostscript.scm @@ -127,6 +127,96 @@ printing, and psresize, for adjusting page sizes.") "See LICENSE in the distribution.")) (home-page "http://knackered.org/angus/psutils/";))) +(define-public artifex-ghostscript + (package +(name "artifex-ghostscript") +(version "9.21") +(source + (origin +(method url-fetch) +(uri (string-append "https://github.com/ArtifexSoftware/"; +"ghostpdl-downloads/releases/download/gs" +(string-delete #\. version) +"/ghostscript-" version ".tar.xz")) +(sha256 + (base32 + "0lyhjcrkmd5fcmh8h56bs4xr9k4jasmikv5vsix1hd4ai0ad1q9b")) +(patches (search-patches "artifex-ghostscript-runpath.patch" + "artifex-ghostscript-CVE-2017-8291.patch")) +(modules '((guix build utils))) +(snippet + ;; Remove bundled libraries. The bundled OpenJPEG is a patched fork so + ;; we leave it, at least for now. + ;; TODO Try unbundling ijs, which is developed alongside Ghostscript. + '(begin +(for-each delete-file-recursively '("freetype" "jbig2dec" "jpeg" +"lcms2" "libpng" +"tiff" "zlib")) +(build-system gnu-build-system) +(outputs '("out" "doc")) ;19 MiB of HTML/PS doc + examples +(arguments + `(#:disallowed-references ("doc") + #:make-flags '("so") + #:configure-flags + (list "--with-system-libtiff" + "LIBS=-lz" + (string-append "ZLIBDIR=" +(assoc-ref %build-inputs "zlib") "/include") + "--enable-dynamic") + #:phases + (modify-phases %standard-phases +(add-after 'unpack 'fix-doc-dir + (lambda _ +;; Honor --docdir. +(substitute* "Makefile.in" +
Re: Switching to Artifex Ghostscript
Ricardo Wurmus writes: > Leo Famulari writes: > >> + (replace 'build >> + (lambda _ >> + ;; Build 'libgs.so', but don't build the statically-linked 'gs' >> + ;; binary (saves 22 MiB). >> + (zero? (system* "make" "so" "-j" >> + (number->string >> (parallel-job-count)) > > Couldn’t we just add “#:make-flags '("so")” and avoid replacing the > build phase? FWIW, I think it's a bad habit to abuse #:make-flags for targets, because the contents of #:make-flags is also passed to 'make' during the 'install' and 'check' phases. IMO, if we want to avoid replacing the build phase in cases like this, it would be better to add a separate #:build-target argument. Thoughts? Mark
Re: What’s next?
On 05/27/2017 at 12:13 Ludovic Courtès writes: > Ricardo Wurmus skribis: > >> Chris Marusich writes: >> >>> Leo Famulari writes: >>> So, I use and recommend `guix pull`! >>> >>> I use it too. Statements by others in this thread that "nobody" uses it >>> or that "everyone" is using Git are mistaken. >>> >>> I use Git when I want to hack on Guix. Otherwise, I use 'guix pull'. >>> IMO, the biggest problem with 'guix pull' is that there is no easy >>> rollback. I can live with long execution times (--fallback is fine, but >>> it'd be nice if substitutes were available more often), and I can live >>> with 'guix pull' causing me to get a version of guix that's broken >>> somehow, but the inability to easily roll back when things go south >>> makes me hesitant to run 'guix pull' regularly. >> >> I believe this can be fixed by adding more links to “.config/guix”, >> i.e. before creating “latest” it would create “2017-05-24:08:21:01.123” >> and then link from there to “latest”. On update it would create a new >> link “2017-05-25:17:45:45.123” and link that to latest. Roll back would >> be a matter of pointing “2017-05-24:08:21:01.123” to “latest”. > > There would be some similarity with profiles. Should we simply use > profiles, and effectively turn ~/.config/guix/latest into a profile, > with generations etc.? +1
Re: What’s next?
On 05/24/2017 at 21:56 Ricardo Wurmus writes: > Catonano writes: > >> 2017-05-24 18:25 GMT+02:00 Jan Nieuwenhuizen : > […] >>> A friend of mine is having a second look at Guix (not SD yet) and one of >>> the most confusing things initially is `guix pull'. "When/how do I use >>> that," he asks...and I can only say: I'm not using that...I think we >>> want this to work--or something like this, we talked about this at >>> FOSDEM, but AFAIK everyone is using Guix with Git. >>> >>> He responds with: then *why* is it in the manual. I have no answer. >>> Possibly I'm wrong and/or my information is outdated? >>> >> >> This is an important point for me too >> >> I realized that everyone is using git and not guix pull just yesterday > […] >> I think this is a problem. It' s unfair to newcomers and it damages Guix as >> a project because it makes the learning curve steeper with not so much of a >> point why. > > There are two reasons why developers use Guix from git: > > * it allows them to add new packages and features to Guix itself. This > is something “guix pull” doesn’t support well. > > * it doesn’t require compiling all of Guix on each update. Hmm, that explains how it feels. Why doesn't it just pull the compiled guix files?
"guix system" summary output?
> This sample omits the most useful output, which is the summary of what > will be done. Just tested with the spinner so I could actually (potentially) see the summary. It seems that "guix package" prints such a summary (yay!), but "guix system reconfigure" doesn't. The latter just starts downloading stuff and then builds stuff - no summary anywhere: ;;; note: source file /x/home/dannym/src/guix/guix/ui.scm ;;; newer than compiled /x/home/dannym/src/guix/guix/ui.go guix system: warning: Your Guix installation is 476 days old. guix system: warning: Consider running 'guix pull' followed by 'guix system reconfigure' to get up-to-date packages and security updates. substitute: updating list of substitutes from 'https://bayfront.guixsd.org'... 100.0% substitute: updating list of substitutes from 'https://mirror.hydra.gnu.org'... 100.0% substitute: updating list of substitutes from 'https://bayfront.guixsd.org'... 100.0% substitute: updating list of substitutes from 'https://mirror.hydra.gnu.org'... 100.0% substitute: updating list of substitutes from 'https://mirror.hydra.gnu.org'... 100.0% updating list of substitutes from 'https://bayfront.guixsd.org'... 100.0% updating list of substitutes from 'https://mirror.hydra.gnu.org'... 100.0% Downloading https://mirror.hydra.gnu.org/guix/nar/zv7rfn8wj4g0nrjzfqgpdnibwy8rjq9q-adwaita-icon-theme-3.24.0.tar.xz (19.8MiB installed)... adwaita-icon-theme-3.24.0.tar.xz 19.8MiB 1.2MiB/s 00:16 [] 100.0% updating list of substitutes from 'https://bayfront.guixsd.org'... 100.0% Downloading https://mirror.hydra.gnu.org/guix/nar/b06kc32xcs4kmidi82p4agrmnypri935-cups-2.2.1-source.tar.gz (9.0MiB installed)... cups-2.2.1-source.tar.gz 9.0MiB 1.6MiB/s 00:06 [] 100.0% |
Re: Switching to Artifex Ghostscript
On Mon, May 29, 2017 at 07:22:18PM -0400, Mark H Weaver wrote: > > Leo Famulari writes: > > > >> + (replace 'build > >> + (lambda _ > >> + ;; Build 'libgs.so', but don't build the statically-linked > >> 'gs' > >> + ;; binary (saves 22 MiB). > >> + (zero? (system* "make" "so" "-j" > >> + (number->string > >> (parallel-job-count)) > > > > Couldn’t we just add “#:make-flags '("so")” and avoid replacing the > > build phase? > > FWIW, I think it's a bad habit to abuse #:make-flags for targets, > because the contents of #:make-flags is also passed to 'make' during the > 'install' and 'check' phases. That's a good point. For this package I think we can just re-use the build phase replacement from the GNU Ghostscript package, as in v1 of my patch. > IMO, if we want to avoid replacing the build phase in cases like this, > it would be better to add a separate #:build-target argument. > > Thoughts? Yes, it could be useful. signature.asc Description: PGP signature