Integrating Guix/Nix Package Manager

phabricator-migrator · February 19, 2024, 5:44pm

Information

ID: 600
PHID: PHID-TASK-ainnc22zrziso3cs2gkh
Author: HulaHoop
Status at Migration Time: open
Priority at Migration Time: Normal

Description

Nix is a powerful package manager for Linux and other Unix systems that makes package management reliable and reproducible. It provides atomic upgrades and rollbacks, side-by-side installation of multiple versions of a package, multi-user package management and easy setup of build environments. Also makes packaging easier than Debian. It also supports compiler hardening flags.

GNU Guix is based on it with some modifications.

Pros:

Has the potential to solve our problem of including external binaries in a safe reproducible way without the Debian freeze restrictions.
Does not interfere with apt or the system config in any way.

Cons:

Usability impact of running two package managers to keep the system updated. Wrapper scripts or some other way to notify users may be needed.

Found the dev thread about GNU Guix’s Debian packaging attempts mentioned in:

There was a GSoC 2016 project to get it into Debian but it didn’t happen for many reasons.

There are good reasons why Guix and Nix do not follow the FHS but that means there will never be a package for them upstream. Attempts to conform to FHS caused Guix functionality to break and would mess up the nice clean install system it has:

https://lists.gnu.org/archive/html/guix-devel/2016-02/msg01126.html

Instead the guix project distributes a signed tarball with instructions to compile and install it which is far from optimal for us:

https://www.gnu.org/software/guix/manual/guix.html#Binary-Installation

Instead of trying to get into Debian, the devs talked about the possibility of providing a .deb via their own repository that does not follow Debian standards but is very convenient for people who want to bootstrap install Guix:

https://lists.gnu.org/archive/html/guix-devel/2016-02/msg01144.html

“Hosting a .deb file on our own server that users could download and
install with dpkg would be perfect for us.”

The blocker for this is Ubuntu’s build process requirements are different from Debian’s and so they shelved the whole thing:

https://lists.gnu.org/archive/html/guix-devel/2016-02/msg01205.html

“Without a fully automated process to build .deb for several distros, I
don’t think we can offer to distribute .deb ourselves. :-/”

Here a Guix enthusiast discusses how to run Guix without compiling it. interesting but doesn’t make it any easier in our case to distribute:

https://dustycloud.org/blog/guix-package-manager-without-make-install/

With this path blocked I decided to look at the Nix manager instead which is what Guix is based on anyway. And fortunately its a better situation. Signed Debian packages for stable are provided! and a script that fetches and validates the .deb. That means with some leg work it can be included in Whonix via our repos:

https://nixos.org/wiki/Installing_Nix_on_Debian

I looked at their package selection and it is impressive. Grsecurity, GNUnet and much more:

https://nixos.org/nixos/packages.html

@ng0 I wrote a proposal draft. Feel free to improve it before I post:

Hello Dear Debian Coders and Maintainers,

I will propose a process for integrating GNU Guix into Debian and working around potential roadblocks that have made the process difficult in the past.

For those unfamiliar, Guix is a package manager that supports reproducible builds, transactional upgrades and roll-backs, unprivileged package management, per-user profiles and more (please see: Features (GNU Guix Reference Manual)).

It uses Guile scheme to define package structure and system configurations. Its unique self-contained package installation allows it to be used seamlessly on any Linux distro while making sure no conflicts between it and the distro’s default package manager arises. As an official GNU project it supports nothing but libre software so it should be compatible with DFSG. Also having Guix in Debian will allow access to more recent versions on software that is developed too rapidly to be otherwise practically usable from the official repos (for example GNUnet).

Potential problems and the way forward:

The fact that the default repo path is /gnu/store conflicts with Debian’s strict FHS guidelines. A solution is to mount or patch /gnu/store to use /opt/guix. However this would break use of the official binary buildfarms and would require Debian to host its own independent instance that works with our customized paths.

There are some missing build/runtime dependencies such as guile-git and guile-ssh that would need packaging first but its not possible without more widespread interest:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850644

A good starting point for a Guix deb package is this latest effort:
GitHub - detrout/debian-guix: Debian packaging recipe for Guix package manager

If you have any further suggestions or requests please post them and the Guix people would be interested to collaborate on whatever it takes to realize this.

I hope to kick-start a dialogue/interest in this project so please share your thoughts. Thanks.

Patrick

2019-07-06 10:40:07 UTC