Re: Inject custom search specification into profile

Here's what currently I do (use-modules (guix packages) (guix build-system trivial) (guix search-paths) (guix profile)) (define (search-paths-placeholder specs) (package (name "search-paths-placeholder") (version "0.0") (source #f)

Inject custom search specification into profile

Hi, Guix users! Recently, I read Guix cookbook and wanna separate some of my packages into a dedicated profile. For example, I wanna put match-theme under ~/.guix-profiles.d/theme/theme. and source ~/.guix-profiles.d/theme/theme/etc/profile in ~/.profile. But my XFCE still unable to find

Re: Security of packages in official repo

Hi Ricardo, On Thu, 26 Nov 2020 at 22:10, Ricardo Wurmus wrote: > Certainly, I do not disagree. When someone does extra work to audit the > code and nobody is there to witness it … “does it make a sound”? :) Thoughtful as a Chinese koan. :-) I am so grateful for all this extra work.

Re: Security of packages in official repo

zimoun writes: > Hi Ricardo, > > On Thu, 26 Nov 2020 at 17:51, Ricardo Wurmus wrote: >> zimoun writes: >>> On Thu, 26 Nov 2020 at 12:32, Phil wrote: >>> However, can anyone point me to, or explain - what is done to audit packages in the official Repo in the first place - i.e. how

Re: Security of packages in official repo

Hi, On Thu, 26 Nov 2020 at 19:07, Phil wrote: > The important point is that the patch is vetted by the members of > guix-patc...@gnu.org mail list. And I assume packages which appear > inappropriate for whatever reason are not accepted by members of this > list? Anyone can subscribe to

Re: Security of packages in official repo

Hi Ricardo, On Thu, 26 Nov 2020 at 17:51, Ricardo Wurmus wrote: > zimoun writes: >> On Thu, 26 Nov 2020 at 12:32, Phil wrote: >> >>> However, can anyone point me to, or explain - what is done to audit >>> packages in the official Repo in the first place - i.e. how do I know >>> that a piece of

Re: Security of packages in official repo

Thanks for the reply Simon. zimoun writes: > Nothing. It is about trust, as with any distribution. Now, you can > audit by yourself the source code, compiled by yourself and check if it > is the same that the substitutes serve you. I understand that Guix makes the process of reproducability

Re: Security of packages in official repo

zimoun writes: > Hi, > > On Thu, 26 Nov 2020 at 12:32, Phil wrote: > >> However, can anyone point me to, or explain - what is done to audit >> packages in the official Repo in the first place - i.e. how do I know >> that a piece of software supplied to me by Guix is not only >> delivered in a

Re: Security of packages in official repo

Hi, On Thu, 26 Nov 2020 at 12:32, Phil wrote: > However, can anyone point me to, or explain - what is done to audit > packages in the official Repo in the first place - i.e. how do I know > that a piece of software supplied to me by Guix is not only > delivered in a safe/reliable fashion, but

Problem on setting up the Cuirass as substitute server

Hi Guix, Trying to setup Cuirass to build a series of packages, I followed the instructions provided in following link: https://guix.gnu.org/manual/en/html_node/Continuous-Integration.html starting cuirass service on my machine, service starts with no error, but when I check the web

Security of packages in official repo

Hi all, I can find a few articles that give a good overview of Guix security with regard to ensuring that what is pulled onto my local server is always a true representation of the packages as intended by the package authors. There's also a good process for alerting Guix of potential security

Re: Workflow with mu4e + magit for sending patchsets to guix?

Fixed: --8<---cut here---start->8--- (defvar ambrevar/known-mailing-list-archives '(("help-guix@gnu.org" . "guix-user") ("guix-de...@gnu.org" . "guix-devel") ("debbugs.gnu.org" . "guix-bugs")) "Alist of mail adresses and their Yhetil name.