wiki/_next/data/Ie9t5zutrXP6Of75Cb5xF/literature.courtesPackagingGrail2021.json

{"pageProps":{"metadata":{"date":"2021-12-28 21:27:18 +08:00","date_modified":"2022-06-21 12:14:07 +08:00>","language":"en","source":""},"title":"The Packaging Grail","hast":{"type":"root","children":[{"type":"element","tagName":"nav","properties":{"className":"toc"},"children":[{"type":"element","tagName":"ol","properties":{"className":"toc-level toc-level-1"},"children":[{"type":"element","tagName":"li","data":{"hookArgs":[{"type":"element","tagName":"h1","properties":{"id":"synopsis"},"children":[{"type":"text","value":"Synopsis"}]}]},"properties":{"className":"toc-item toc-item-h1"},"children":[{"type":"element","tagName":"a","properties":{"className":"toc-link toc-link-h1","href":"/literature.courtesPackagingGrail2021#synopsis"},"children":[{"type":"text","value":"Synopsis"}]}]},{"type":"element","tagName":"li","data":{"hookArgs":[{"type":"element","tagName":"h1","properties":{"id":"potential-problems"},"children":[{"type":"text","value":"Potential problems"}]}]},"properties":{"className":"toc-item toc-item-h1"},"children":[{"type":"element","tagName":"a","properties":{"className":"toc-link toc-link-h1","href":"/literature.courtesPackagingGrail2021#potential-problems"},"children":[{"type":"text","value":"Potential problems"}]}]},{"type":"element","tagName":"li","data":{"hookArgs":[{"type":"element","tagName":"h1","properties":{"id":"presenters-wish"},"children":[{"type":"text","value":"Presenter's wish"}]}]},"properties":{"className":"toc-item toc-item-h1"},"children":[{"type":"element","tagName":"a","properties":{"className":"toc-link toc-link-h1","href":"/literature.courtesPackagingGrail2021#presenters-wish"},"children":[{"type":"text","value":"Presenter's wish"}]}]}]}]},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":":properties:\n:id:       30d6a3d2-42f3-4f49-8d4c-bf433dc82350\n:roam"},{"type":"element","tagName":"sub","properties":{},"children":[{"type":"text","value":"refs"}]},{"type":"text","value":": ["},{"type":"element","tagName":"a","properties":{"href":"cite:@courtesPackagingGrail2021"},"children":[{"type":"text","value":"cite:@courtesPackagingGrail2021"}]},{"type":"text","value":"]\n:end:\n"}]},{"type":"element","tagName":"h1","properties":{"id":"synopsis"},"children":[{"type":"text","value":"Synopsis"}]},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"a primer to "},{"type":"element","tagName":"a","properties":{"href":"/2020-08-19-08-21-44"},"children":[{"type":"text","value":"Guix package manager"}]},{"type":"text","value":" and its goals\n"}]},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"it is free as in "},{"type":"element","tagName":"a","properties":{"href":"/2021-07-22-14-25-13"},"children":[{"type":"text","value":"Free software"}]}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"a universal package manager that tries to cover all dependencies from different programming languages similar to "},{"type":"element","tagName":"a","properties":{"href":"/tools.nix"},"children":[{"type":"text","value":"Nix package manager"}]}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"transparent through the "},{"type":"element","tagName":"a","properties":{"href":"/2020-09-14-10-46-15"},"children":[{"type":"text","value":"Reproducible builds"}]},{"type":"text","value":" initiative integrating it into the package manager (e.g., "},{"type":"element","tagName":"code","properties":{"className":["inline-verbatim"]},"children":[{"type":"text","value":"guix challenge"}]},{"type":"text","value":")\n"}]}]}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"focus on isolated builds leading to bit-identical builds and "},{"type":"element","tagName":"a","properties":{"href":"roam:Bootstrappable builds"},"children":[{"type":"text","value":"roam:Bootstrappable builds"}]},{"type":"text","value":" (building everything from source) enforcing further transparency and more security (e.g., \"Trusting trust\" attacks, creating backdoors through compiler bugs)\n"}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"making efforts to reduce the binary blobs required to boot an operating system from scratch through GNU Mes\n"}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"the balance to the right way versus pragmatism;\n  other solutions may present to be faster and more convenient versus doing things the \"right way\" (e.g., comparing Pytorch package from Guix built from source versus Pypi containing prebuilt binaries; see "},{"type":"element","tagName":"a","properties":{"href":"/Potential%20problems"},"children":[{"type":"text","value":"Potential problems"}]},{"type":"text","value":");\n  in this case, Guix is drawing the line by providing tools to make packaging easier (e.g., "},{"type":"element","tagName":"code","properties":{"className":["inline-verbatim"]},"children":[{"type":"text","value":"guix import"}]},{"type":"text","value":")\n"}]}]}]},{"type":"element","tagName":"h1","properties":{"id":"potential-problems"},"children":[{"type":"text","value":"Potential problems"}]},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"binary packages in package repositories (e.g., "},{"type":"element","tagName":"code","properties":{"className":["inline-verbatim"]},"children":[{"type":"text","value":"torch"}]},{"type":"text","value":" package in Pypi) "}]},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"developer-uploaded binaries which may contain other modifications and harder to verify\n"}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"no indication of sources from random binaries\n"}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"licenses issues may pop up\n"}]}]}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"no standard way to reproduce builds and verify so anyone can upload anything;\n  this can create supply chain issues\n"}]},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"see the left-pad issue from npm that happened years ago\n"}]}]}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"with project-specific and language-specific package managers (e.g., npm, cargo, pip), a lot of the overall reach of the software can feel isolated;\n  Guix is intending to at least provide a way to unify them (as it is one of the goals, after all)\n"}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"mostly related to software testing — e.g., missing test dependencies,\n"}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"hosted source can be different from upstream;\n  "}]}]}]},{"type":"element","tagName":"h1","properties":{"id":"presenters-wish"},"children":[{"type":"text","value":"Presenter's wish"}]},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"move non-free software"}]},{"type":"text","value":";\n  at the very least, move it to another repository to let people make informed decisions;\n  not only this cannot be reproduced well but also impedes security\n"}]},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"as far as I can remember, this is considered from the Flathub maintainers when it will eventually be a popular host of apps for both free and proprietary apps\n"}]}]}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"disallow developer-uploaded binaries"}]},{"type":"text","value":";\n  the talk presented an example with the previous case with Debian allowing it some time ago;\n  if it is allowed, at least provide a way to reproduce it;\n"}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"accurate licensing info"}]}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"accurate package data from repositories"}]},{"type":"text","value":" (e.g., dependencies, license)\n"}]}]},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"good description/synopsis"}]}]}]}]}]},"backlinks":[]},"__N_SSG":true}