Re: Avoiding tarballs that contain pre-built artifacts

[Olivier Dion]

On Tue, 10 Mar 2026, Ludovic Courtès <l...@gnu.org> wrote:
> Hello!
>
> Janneke Nieuwenhuizen <jann...@gnu.org> skribis:
>
>>> And, there’s some good news!  I hear fellow hackers have been working on
>>> this thing called BLUE, which could address our tarball problem as well!
>>> That is, once Guix uses BLUE as its build system, ‘make dist’ is
>>> effectively gone,
>>
>> Well, "someone" actually contributed some patches to BLUE *), making sure
>> that `make dist' would produce a reproducible source tarball ootb ;)
>>
>> Possibly BLUE should support a `make git-dist' or something; but as a
>> generic build system you'd probably not want have a hard dependency on
>> git?  Dunno...
>
> [...]
>
>> *) https://codeberg.org/lapislazuli/blue/pulls/251
>>    https://codeberg.org/lapislazuli/blue/pulls/258
>
> Nice!  I’m looking at ‘tarball.scm’ and it’s not entirely clear what
> ‘inputs’ contains: can it be more than just the list of source files
> (checked in)?  I would expect no?

Inputs is a list of:

 - A source file (string)
 - Another buildable (object base dependency tracking; e.g. a template-file)
 - An external dependency (e.g. something resolved by pkg-config)

As described in the <buildable> (blue/types/buildable.scm) definition:

    (inputs
     #:getter %buildable-inputs
     #:init-value '()
     #:init-keyword #:inputs
     #:type (type-or-list-of-type?
             (or?
              string?
              buildable?
              dependency?)))


The tarball manifest builder can filter the tarball inputs to only take
strings (source files), and possibly outputs of other buildables (i.e
generated source files, artifacts).

> Put differently, when would one ask BLUE to create a tarball instead of
> using ‘git archive’?

I see some cases:

  - The project is not using Git but another VCS.
  
  - Git archive is not flexible enough for what is required

    - The wanted compression format is not supported by Git

Otherwise, `git-archive(1)' is flexible enought to do a lots of things.

I leave the choice to the users to decide what they want to introduce as
a build dependency:

 - git :
  - dependencies: asciidoc@9.1.0 bash-minimal@5.2.37 bash@5.2.37 
coreutils-minimal@9.1 curl@8.6.0 docbook-xml@4.5 docbook-xsl@1.79.2-0.fe16c90 
docbook2x@0.8.8 expat@2.7.1 gettext-minimal@0.23.1 glib@2.83.3
+ libsecret@0.21.4 libxslt@1.1.43 openssl@3.0.8 pcre2@10.42 
perl-authen-sasl@2.16 perl-cgi@4.55 perl-io-socket-ssl@2.089 
perl-net-smtp-ssl@1.04 perl-term-readkey@2.38 perl@5.36.0 pkg-config@0.29.2 
python@3.11.14
+ sed@4.9 subversion@1.14.5 tcl@8.6.12 texinfo@6.8 tk@8.6.12
xmlto@0.0.28 zlib@1.3.1

 - tar :
   - dependencies:

Thanks,
Olivier
-- 
Olivier Dion