Hi Guix! So, I guess we need to start collecting talk proposals for the online Guix Day in November. Here's mine :)
I'd like to talk about the Maven bootstrap and the Maven Build System. Ensuring that software is built entirely from source is an essential practice to ensure user Freedom, as well as for auditability and security. Unfortunately, the Java ecosystem is very complex and presents some interesting challenges when building from source. One of these challenges is Maven, a build tool and package manager that is used by many if not most of the Java developpers nowadays. One key challenge is that Maven is itself a Java package, that is built with Maven and has a lot of dependencies, that themselves use Maven. My talk will present the current state of the bootstrap and how we break the various dependency cycles that occur. The recent addition of the maven build system is a major step towards a good support of the Java ecosystem in Guix. We will discuss how Maven works, what it expects, and how Guix can accomodate it to build offline, reproducibly, with no trusted binary. I hope this talk will not only give you a good overview of how maven's bootstrap is done, but also give you ideas and directions to implement similar bootstrap stories for other ecosystems.