GNU bug report logs - #27261
guix package -u should warn about non-existent packages

Previous Next

Package: guix;

Reported by: Mark H Weaver <mhw <at> netris.org>

Date: Tue, 6 Jun 2017 00:50:02 UTC

Severity: normal

Done: ludo <at> gnu.org (Ludovic Courtès)

Bug is archived. No further changes may be made.

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 27261 in the body.
You can then email your comments to 27261 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to bug-guix <at> gnu.org:
bug#27261; Package guix. (Tue, 06 Jun 2017 00:50:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Mark H Weaver <mhw <at> netris.org>:
New bug report received and forwarded. Copy sent to bug-guix <at> gnu.org. (Tue, 06 Jun 2017 00:50:02 GMT) Full text and rfc822 format available.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Mark H Weaver <mhw <at> netris.org>
To: bug-guix <at> gnu.org
Subject: guix package -u should warn about non-existent packages
Date: Mon, 05 Jun 2017 20:48:43 -0400
In order to guard against users unwittingly using old software with
unpatched security flaws, "guix package -u" should issue a warning if
any packages in the profile that match the provided patterns are not
found in the set of available packages.

       Mark




Reply sent to ludo <at> gnu.org (Ludovic Courtès):
You have taken responsibility. (Sun, 25 Jun 2017 20:31:01 GMT) Full text and rfc822 format available.

Notification sent to Mark H Weaver <mhw <at> netris.org>:
bug acknowledged by developer. (Sun, 25 Jun 2017 20:31:02 GMT) Full text and rfc822 format available.

Message #10 received at 27261-done <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Mark H Weaver <mhw <at> netris.org>
Cc: 27261-done <at> debbugs.gnu.org
Subject: Re: bug#27261: guix package -u should warn about non-existent packages
Date: Sun, 25 Jun 2017 22:30:10 +0200
Mark H Weaver <mhw <at> netris.org> skribis:

> In order to guard against users unwittingly using old software with
> unpatched security flaws, "guix package -u" should issue a warning if
> any packages in the profile that match the provided patterns are not
> found in the set of available packages.

Fixed in a1b46bdc069e6e3bbc5b171fafbc40213611ff1f, thanks!

Ludo’.




Information forwarded to bug-guix <at> gnu.org:
bug#27261; Package guix. (Sun, 25 Jun 2017 23:54:01 GMT) Full text and rfc822 format available.

Message #13 received at 27261 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: 27261 <at> debbugs.gnu.org, ludo <at> gnu.org, mhw <at> netris.org
Subject: Re: bug#27261: guix package -u should warn about non-existent packages
Date: Sun, 25 Jun 2017 19:53:26 -0400
[Message part 1 (text/plain, inline)]
On Sun, Jun 25, 2017 at 10:30:10PM +0200, Ludovic Courtès wrote:
> Mark H Weaver <mhw <at> netris.org> skribis:
> > In order to guard against users unwittingly using old software with
> > unpatched security flaws, "guix package -u" should issue a warning if
> > any packages in the profile that match the provided patterns are not
> > found in the set of available packages.
> 
> Fixed in a1b46bdc069e6e3bbc5b171fafbc40213611ff1f, thanks!

I noticed this doesn't work in some cases, although I'm not sure exactly
when it will work and when it won't.

I ran `guix pull` after this missing package warning was implemented,
but before I pushed afc9d8ec2b724b67f (gnu: Add jmtpfs).

I installed jmtpfs from a Git checkout, and then ran `guix package -u .`

As expected, Guix complained that the jmtpfs package does not exist.

However, it did not complain about the syncthing package in my profile,
even though syncthing is not available in Guix. The syncthing package is
on a branch that's not checked out, and there is no stray
'gnu/packages/syncthing.go' file.

I thought it might be caused by the presence of the qsyncthingtray
package in Guix (not in my profile), but even after I deleted that
package and rebuilt Guix from a fresh checkout, I still had this
problem.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix <at> gnu.org:
bug#27261; Package guix. (Mon, 26 Jun 2017 08:02:02 GMT) Full text and rfc822 format available.

Message #16 received at 27261 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Leo Famulari <leo <at> famulari.name>
Cc: 27261 <at> debbugs.gnu.org, mhw <at> netris.org
Subject: Re: bug#27261: guix package -u should warn about non-existent packages
Date: Mon, 26 Jun 2017 10:01:03 +0200
Hello,

Leo Famulari <leo <at> famulari.name> skribis:

> I ran `guix pull` after this missing package warning was implemented,
> but before I pushed afc9d8ec2b724b67f (gnu: Add jmtpfs).
>
> I installed jmtpfs from a Git checkout, and then ran `guix package -u .`
>
> As expected, Guix complained that the jmtpfs package does not exist.
>
> However, it did not complain about the syncthing package in my profile,
> even though syncthing is not available in Guix. The syncthing package is
> on a branch that's not checked out, and there is no stray
> 'gnu/packages/syncthing.go' file.

Could you check whether “guix package -A syncthing” shows it there?  The
warning should appear as soon as we’re upgrading a package that’s
missing.

Thanks,
Ludo’.




Information forwarded to bug-guix <at> gnu.org:
bug#27261; Package guix. (Mon, 26 Jun 2017 18:34:01 GMT) Full text and rfc822 format available.

Message #19 received at 27261 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 27261 <at> debbugs.gnu.org, mhw <at> netris.org
Subject: Re: bug#27261: guix package -u should warn about non-existent packages
Date: Mon, 26 Jun 2017 14:32:54 -0400
[Message part 1 (text/plain, inline)]
On Mon, Jun 26, 2017 at 10:01:03AM +0200, Ludovic Courtès wrote:
> Could you check whether “guix package -A syncthing” shows it there?  The
> warning should appear as soon as we’re upgrading a package that’s
> missing.

I get no results when I do `./pre-inst-env guix package -A syncthing`
from the repo where I removed qsyncthingtray.

`guix package -A syncthing` shows a result for qsyncthingtray, because
that is a "plain" Guix, from `guix pull`, set up as described in Binary
Installation:

$ ls -l $(which guix)
lrwxrwxrwx 1 root staff 54 Aug 14  2015 /usr/local/bin/guix -> /var/guix/profiles/per-user/root/guix-profile/bin/guix
$ ls -l ~/.config/guix/latest 
lrwxrwxrwx 1 leo leo 55 Jun 25 19:19 /home/leo/.config/guix/latest -> /gnu/store/jbrn4pixmrqmqk8jmx533cnqhjhm17sb-guix-latest

But, that's not the Guix that I expect to be queried for packages. Maybe
there is some unexpected interaction between the various copies of Guix?

I'll try this on GuixSD today or tomrrow.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix <at> gnu.org:
bug#27261; Package guix. (Mon, 26 Jun 2017 18:52:01 GMT) Full text and rfc822 format available.

Message #22 received at 27261 <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <mbakke <at> fastmail.com>
To: Leo Famulari <leo <at> famulari.name>, Ludovic Courtès
 <ludo <at> gnu.org>
Cc: 27261 <at> debbugs.gnu.org
Subject: Re: bug#27261: guix package -u should warn about non-existent packages
Date: Mon, 26 Jun 2017 20:51:49 +0200
[Message part 1 (text/plain, inline)]
Leo Famulari <leo <at> famulari.name> writes:

> On Mon, Jun 26, 2017 at 10:01:03AM +0200, Ludovic Courtès wrote:
>> Could you check whether “guix package -A syncthing” shows it there?  The
>> warning should appear as soon as we’re upgrading a package that’s
>> missing.
>
> I get no results when I do `./pre-inst-env guix package -A syncthing`
> from the repo where I removed qsyncthingtray.

I just came across this today too on a GuixSD system. `guix package -u`
warned that my not-yet-upstream "icedtea-web" package does not exist,
but had no problem with "chromium" installed the same way.

No GUIX_PACKAGE_PATH, and ~/.config/guix/latest is a symlink to a `guix
pull` build. The packages were installed through `./pre-inst-env`.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix <at> gnu.org:
bug#27261; Package guix. (Tue, 27 Jun 2017 13:57:01 GMT) Full text and rfc822 format available.

Message #25 received at 27261 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Marius Bakke <mbakke <at> fastmail.com>
Cc: 27261 <at> debbugs.gnu.org, Leo Famulari <leo <at> famulari.name>
Subject: Re: bug#27261: guix package -u should warn about non-existent packages
Date: Tue, 27 Jun 2017 15:56:21 +0200
Marius Bakke <mbakke <at> fastmail.com> skribis:

> Leo Famulari <leo <at> famulari.name> writes:
>
>> On Mon, Jun 26, 2017 at 10:01:03AM +0200, Ludovic Courtès wrote:
>>> Could you check whether “guix package -A syncthing” shows it there?  The
>>> warning should appear as soon as we’re upgrading a package that’s
>>> missing.
>>
>> I get no results when I do `./pre-inst-env guix package -A syncthing`
>> from the repo where I removed qsyncthingtray.
>
> I just came across this today too on a GuixSD system. `guix package -u`
> warned that my not-yet-upstream "icedtea-web" package does not exist,
> but had no problem with "chromium" installed the same way.
>
> No GUIX_PACKAGE_PATH, and ~/.config/guix/latest is a symlink to a `guix
> pull` build. The packages were installed through `./pre-inst-env`.

Hmm it all depends on whether the packages are visible to Guix via
GUIX_PACKAGE_PATH.  Are you using the same Guix in both cases?  No
‘sudo’?

Ludo’.




Information forwarded to bug-guix <at> gnu.org:
bug#27261; Package guix. (Tue, 27 Jun 2017 19:42:01 GMT) Full text and rfc822 format available.

Message #28 received at 27261 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Leo Famulari <leo <at> famulari.name>
Cc: 27261 <at> debbugs.gnu.org, mhw <at> netris.org
Subject: Re: bug#27261: guix package -u should warn about non-existent packages
Date: Tue, 27 Jun 2017 21:41:16 +0200
Hi Leo,

Leo Famulari <leo <at> famulari.name> skribis:

> On Mon, Jun 26, 2017 at 10:01:03AM +0200, Ludovic Courtès wrote:
>> Could you check whether “guix package -A syncthing” shows it there?  The
>> warning should appear as soon as we’re upgrading a package that’s
>> missing.
>
> I get no results when I do `./pre-inst-env guix package -A syncthing`
> from the repo where I removed qsyncthingtray.

So does “./pre-inst-env guix package -u syncthing” raise a warning?
It should.

> `guix package -A syncthing` shows a result for qsyncthingtray, because
> that is a "plain" Guix, from `guix pull`, set up as described in Binary
> Installation:
>
> $ ls -l $(which guix)
> lrwxrwxrwx 1 root staff 54 Aug 14  2015 /usr/local/bin/guix -> /var/guix/profiles/per-user/root/guix-profile/bin/guix
> $ ls -l ~/.config/guix/latest 
> lrwxrwxrwx 1 leo leo 55 Jun 25 19:19 /home/leo/.config/guix/latest -> /gnu/store/jbrn4pixmrqmqk8jmx533cnqhjhm17sb-guix-latest
>
> But, that's not the Guix that I expect to be queried for packages. Maybe
> there is some unexpected interaction between the various copies of Guix?

I don’t think so.  But maybe I’m missing something!

Ludo’.




bug archived. Request was from Debbugs Internal Request <help-debbugs <at> gnu.org> to internal_control <at> debbugs.gnu.org. (Wed, 26 Jul 2017 11:24:04 GMT) Full text and rfc822 format available.

This bug report was last modified 6 years and 247 days ago.

Previous Next


GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.