mbox

[bug#38441,0/5] Record operating system provenance info

Message ID 20191130223013.14257-1-ludo@gnu.org
Headers show

Message

Ludovic Courtès Nov. 30, 2019, 10:30 p.m. UTC
Hello Guix!

This patch series allows ‘guix system’ to record provenance info
about a system in its output: the system itself (e.g.,
/run/current-system) now contains three more files: “channels.scm”,
“configuration.scm”, and “provenance” (a summary of the first two
files.)

That means you can always inspect a deployed system to find its own
“source”.  In some cases, you can even run something like:

      guix time-machine \
        -C /var/guix/profiles/system-N-link/channels.scm -- \
        system reconfigure \
        /var/guix/profiles/system-N-link/configuration.scm

to rebuild generation N of your system.  Pretty cool, no?  :-)

Otherwise you can simply run:

  guix system describe

to see where your OS comes from.

Provenance tracking is implemented as a service.  The service is
automatically added by ‘guix system init’, ‘reconfigure’, and by
‘guix deploy’.  For other commands, one can pass ‘--save-provenance’
to turn it on.

This was long overdue!

This has interesting implications on trustworthiness: you can
distribute a VM/Docker image with provenance info, and anyone
can reproduce it and ensure they obtain the same bits (well, ideally,
because I guess a few steps may still not be bit-reproducible).

Thoughts?

Thanks,
Ludo’.

Ludovic Courtès (5):
  services: Add 'provenance-service-type'.
  guix system: Use 'provenance-service-type', add "--save-provenance".
  machine: Add provenance tracking to each machine operating system.
  guix system: "list-generations" displays provenance info.
  guix system: Add "describe" action.

 doc/guix.texi           | 109 +++++++++++++++++++++++++++++++++++++---
 gnu/machine.scm         |   7 ++-
 gnu/services.scm        |  87 ++++++++++++++++++++++++++++++++
 gnu/system.scm          |  10 ++++
 guix/scripts/pull.scm   |   1 +
 guix/scripts/system.scm | 107 ++++++++++++++++++++++++++++++++-------
 6 files changed, 293 insertions(+), 28 deletions(-)

Comments

Simon Tournier Dec. 2, 2019, 12:12 p.m. UTC | #1
Hi Ludo,

On Sat, 30 Nov 2019 at 23:31, Ludovic Courtès <ludo@gnu.org> wrote:

[...]

> Thoughts?

Really cool!

This is a killer feature IMHO compared to the Dockerfile approach. Let
spread the world. ;-)


Cheers,
simon
Ludovic Courtès Dec. 7, 2019, 12:03 a.m. UTC | #2
Hello!

Ludovic Courtès <ludo@gnu.org> skribis:

>   services: Add 'provenance-service-type'.
>   guix system: Use 'provenance-service-type', add "--save-provenance".
>   machine: Add provenance tracking to each machine operating system.
>   guix system: "list-generations" displays provenance info.
>   guix system: Add "describe" action.

Pushed!

zimoun <zimon.toutoune@gmail.com> skribis:

> Really cool!
>
> This is a killer feature IMHO compared to the Dockerfile approach. Let
> spread the world. ;-)

Glad you like it, thanks for your feedback!  :-)

Ludo’.