GNU Guix

Package manager,
system distribution
and more…

+ +

+ Hello, my name is Chris, and we're going to take a look at + a software project called GNU Guix. + + Before we begin, hands up if you're excited about package + managers? + + I'd prefer to cover only some of the material I've got, + really well, rather than cover all of it badly, so please + interrupt, and jump in with questions as and when they + come to you. + + I've not planned any live demos explicitly, but I'm using + GuixSD on this laptop, and am happy to attempt to demo + stuff. + + I first found out about Guix sometime in late 2015, early + 2016. + + I remember installing it the night before FOSDEM, a free + software conference in Brussles, back in January 2016. At + FOSDEM that year there were many talks about Guix in the + GNU Guile devroom. + + I started using and contributing to Guix soon after. + + Maybe some of you are using Guix already, maybe some of + you have heard of it, but don't know much about it, and + maybe some of you haven't heard of Guix before freenode + live. + + In any case, I hope most of you will learn something about + Guix in the next hour. + + I'm going to try and cover: + - some of the technical fundamentals + - how you can use guix as a package manager + - how you can use Guix to manage systems and services + - and finally, ways in which you can extend Guix +

+ +

+ Guix... +

+ Why another package management tool? +

+ + +

+ +

User
Control / Freedom

+ +

+ Installing software is something which I think has been + getting easier, and better. + + Package managers have helped a lot with this, but often + there is still room for improvement. + + Sometimes, package managers have the option to install + software without building it from source by fetching some + corresponding binary package. But you may want to build + the software from source anyway, and this can be tricky. + + There can be a few reasons for building from source. There + might not be a corresponding binary package available, you + might want to not have to trust the available binary + packages, or you may want to modify the software, patching + a security vulnerability for example. + + Also, when installing software, there can be issues with + package conflicts. + + With some package managers, some packages may conflict + with others, and some may conflict with different versions + of the same package. Making it difficult to meet the needs + of multiple pieces of software, or multiple users. + + Even if you make it through installing software, many + people using software are stuck in a world where if they + take the risk to remove or upgrade some software on there + computer, then something may break. + + Now, of course, updating software may introduce bugs, but + sometimes updating one bit of software can break a related + bit of software that wasn't updated. + + The same goes for installing and removing software, + sometimes, unfortunately, some other piece of software + needed what was removed, or an existing piece of software + conflicts with the newly installed software. + + On the whole, being able to install software from source, + or using prebuilt binary packages, avoiding conflicts + between packages, even multiple versions of the same + package, and being able to remove or upgrade software, + without worrying about causing problems are all issues of + user control and user freedom. + + I think Guix is a tool that can help, so how does it work? +

+ +

How does Guix work?

+ + +

+ +

1993

+ First Debian release + +

+ +

2004

Nix: A Safe and Policy-Free System for + Software Deployment +

+ +

2012

+ Guix announced +

+ +

2017

+ freenode #live +

+ +

+ At the top, we have Debian. Which started in 1993, and has + grown to be a very popular free software distribution. + + I love Debian. I've used it quite a bit, including writing + packages for software and services. + + If I make any comparisons to it, its not because I think + its bad, just that its what I was using, before I began + using Guix more and more. + + A while after the Debian project started, and quite a long + time ago now, back in 2004, the first paper on a piece of + software called Nix was published. + + I didn't find out about Nix until I found out about Guix, + but Nix is important to mention, as some of the key + concepts underlying Guix come from Nix. + + Around 5 years ago now, the Guix project was started bu + Ludovic Courtès, using some of the key ideas from Nix, and + adding some more. +

+ +

+ + + +

+ +

The store

+ +

/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10
+├── bin
+│   └── hello
+└── share
+    ├── info
+    │   └── ...
+    ├── locale
+    │   └── ...
+    └── man
+        └── ...
+

+ +

+ We start with the store, a special directory where files, + and the outputs from derivations that have been built + successfully are stored. + + When using Guix, the location of the store is /gnu/store. + + The store contains store items, and there is a database + that contains information on these, such as how the store + items refer to each other. + + (Next) + + Shown here is an example store item. + + In this case, its a directory, containing GNU Hello. + + Operations on the store should be performed by the build + daemon, which helps ensure that the store is maintained + correctly. To protect the integrity of the store, it is + useful to make it read only, to everything but the build + daemon. + + (Next) + + The hash here is really important, and that comes from the + derivation which is used to create the store item. +

+ +


+            $ guix build --derivations hello
+/gnu/store/1drc59xkcvgdphzgylxm41ln9p5dwbgn-hello-2.10.drv
+

+ +


+            Derive(
+  [("out","/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10","","")],
+  [("/gnu/store/0gabs9i1zawd406rkkr7l15ifg61s34r-glibc-2.25.drv",["out"]),
+   ("/gnu/store/1lqw4mz8xzjhnb65kc1nvk8wg39spv5j-hello-2.10.tar.gz.drv",["out"]),
+   ("/gnu/store/1vmhamqwgs3qa7rw28am5rm3b9fjs163-file-5.30.drv",["out"]),
+   ("/gnu/store/23h9fzinl5j1s5x7r2i155f1m7ify9wl-ld-wrapper-0.drv",["out"]),
+   ("/gnu/store/3li1y3cc8rkr4d0q9h8bkvl4h3macnf6-bash-minimal-4.4.12.drv",["out"]),
+   ("/gnu/store/6y5h0pbqci67ql1ij5crkchjzmxkafbv-gawk-4.1.4.drv",["out"]),
+   ("/gnu/store/8xmbpyfnh5cdrk9fmx8j67894bq9vl1r-module-import.drv",["out"]),
+   ("/gnu/store/9sahk6fh2p5k631rxl6amx0cd4z8jn0s-diffutils-3.6.drv",["out"]),
+   ("/gnu/store/cm2f8yxfpy353kxbq5gl7whzvmkl9niv-make-4.2.1.drv",["out"]),
+   ("/gnu/store/fqx5lcb8lhdxkw1dwcgahnqaxgaycgb1-tar-1.29.drv",["out"]),
+   ("/gnu/store/i5fzg4cq88yvl2i7bsnqprzgq494bpdm-patch-2.7.5.drv",["out"]),
+   ("/gnu/store/iwzysdzl3yphqa0c0km8liiimcsrxmvd-glibc-utf8-locales-2.25.drv",["out"]),
+   ("/gnu/store/jwsvpyyxkmyg0wk3cic3b9q9wgimphkz-findutils-4.6.0.drv",["out"]),
+   ("/gnu/store/m5kd44n51ns8zlc8mvii497xc2siydpb-coreutils-8.27.drv",["out"]),
+   ("/gnu/store/pjgbs80jhzpm7lfpsa5dp6jgxkcv6n56-bzip2-1.0.6.drv",["out"]),
+   ("/gnu/store/qgcr4gp3qz098yh6zsnn97dg4h8d2nbn-sed-4.4.drv",["out"]),
+   ("/gnu/store/r49cqbngzhn8q1qr6cjsm4vs85vwzl9i-xz-5.2.2.drv",["out"]),
+   ("/gnu/store/rkjydj936a096s70bxq7sz77bbxzfqvd-gzip-1.8.drv",["out"]),
+   ("/gnu/store/vk9xdybvknvnnaxavdk2q43yvdq5h47r-binutils-2.28.drv",["out"]),
+   ("/gnu/store/wrlssahrl79njwzwv8clcq8vdh2syppx-module-import-compiled.drv",["out"]),
+   ("/gnu/store/xz5ikvwa6pyz11h0a5hmzf9rxyi5xjzw-guile-2.2.2.drv",["out"]),
+   ("/gnu/store/zb0wzrfgiydmr8gbxywyrmg6yp68w4fj-linux-libre-headers-4.4.47.drv",["out"]),
+   ("/gnu/store/zxiy6cnd05p90hmyk1mvr30lm17ghwim-grep-3.0.drv",["out"]),
+   ("/gnu/store/zxkwsk4g0m7j2p54l7xp2gblb6v4zddf-gcc-5.4.0.drv",["out"])],
+  ["/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
+   "x86_64-linux",
+   "/gnu/store/d8gkn84yqacjr80pzicz1ka3y2s1f2x0-guile-2.2.2/bin/guile",
+  ["--no-auto-compile",
+   "-L",
+   "/gnu/store/xhwmxry8kkmq7897558qmcmfsx8r1z45-module-import",
+   "/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
+  [("GUILE_LOAD_COMPILED_PATH","/gnu/store/r7sf4w2wwrbxbcf04pi9a5gkdhzaya2g-module-import-compiled"),
+   ("out","/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10")]
+)
+

+ +

+ This is an example derivation for the GNU hello package. + + Normally, there is no formatting or highlighting, but I've + added some here to make it more understandable. + + (Next) + + The first thing to notice is the output file, highlighted + here in green. It appears twice, the first time is for the + build daemon, so it knows what to expect, and the second + time is for the builder, so it knows where to put the + output. + + The hash part of the filename is computed by hashing + something which looks like this, but not containing the + output file, as you haven't computed the hash yet. + + So lets remove the output file, and look at what goes in + to the hash. +

+ +

$ guix build --derivations hello
+/gnu/store/1drc59xkcvgdphzgylxm41ln9p5dwbgn-hello-2.10.drv

+ +

Derive(
+  [("out","","","")],
+  [("/gnu/store/0gabs9i1zawd406rkkr7l15ifg61s34r-glibc-2.25.drv",["out"]),
+   ("/gnu/store/1lqw4mz8xzjhnb65kc1nvk8wg39spv5j-hello-2.10.tar.gz.drv",["out"]),
+   ("/gnu/store/1vmhamqwgs3qa7rw28am5rm3b9fjs163-file-5.30.drv",["out"]),
+   ("/gnu/store/23h9fzinl5j1s5x7r2i155f1m7ify9wl-ld-wrapper-0.drv",["out"]),
+   ("/gnu/store/3li1y3cc8rkr4d0q9h8bkvl4h3macnf6-bash-minimal-4.4.12.drv",["out"]),
+   ("/gnu/store/6y5h0pbqci67ql1ij5crkchjzmxkafbv-gawk-4.1.4.drv",["out"]),
+   ("/gnu/store/8xmbpyfnh5cdrk9fmx8j67894bq9vl1r-module-import.drv",["out"]),
+   ("/gnu/store/9sahk6fh2p5k631rxl6amx0cd4z8jn0s-diffutils-3.6.drv",["out"]),
+   ("/gnu/store/cm2f8yxfpy353kxbq5gl7whzvmkl9niv-make-4.2.1.drv",["out"]),
+   ("/gnu/store/fqx5lcb8lhdxkw1dwcgahnqaxgaycgb1-tar-1.29.drv",["out"]),
+   ("/gnu/store/i5fzg4cq88yvl2i7bsnqprzgq494bpdm-patch-2.7.5.drv",["out"]),
+   ("/gnu/store/iwzysdzl3yphqa0c0km8liiimcsrxmvd-glibc-utf8-locales-2.25.drv",["out"]),
+   ("/gnu/store/jwsvpyyxkmyg0wk3cic3b9q9wgimphkz-findutils-4.6.0.drv",["out"]),
+   ("/gnu/store/m5kd44n51ns8zlc8mvii497xc2siydpb-coreutils-8.27.drv",["out"]),
+   ("/gnu/store/pjgbs80jhzpm7lfpsa5dp6jgxkcv6n56-bzip2-1.0.6.drv",["out"]),
+   ("/gnu/store/qgcr4gp3qz098yh6zsnn97dg4h8d2nbn-sed-4.4.drv",["out"]),
+   ("/gnu/store/r49cqbngzhn8q1qr6cjsm4vs85vwzl9i-xz-5.2.2.drv",["out"]),
+   ("/gnu/store/rkjydj936a096s70bxq7sz77bbxzfqvd-gzip-1.8.drv",["out"]),
+   ("/gnu/store/vk9xdybvknvnnaxavdk2q43yvdq5h47r-binutils-2.28.drv",["out"]),
+   ("/gnu/store/wrlssahrl79njwzwv8clcq8vdh2syppx-module-import-compiled.drv",["out"]),
+   ("/gnu/store/xz5ikvwa6pyz11h0a5hmzf9rxyi5xjzw-guile-2.2.2.drv",["out"]),
+   ("/gnu/store/zb0wzrfgiydmr8gbxywyrmg6yp68w4fj-linux-libre-headers-4.4.47.drv",["out"]),
+   ("/gnu/store/zxiy6cnd05p90hmyk1mvr30lm17ghwim-grep-3.0.drv",["out"]),
+   ("/gnu/store/zxkwsk4g0m7j2p54l7xp2gblb6v4zddf-gcc-5.4.0.drv",["out"])],
+  ["/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
+   "x86_64-linux",
+   "/gnu/store/d8gkn84yqacjr80pzicz1ka3y2s1f2x0-guile-2.2.2/bin/guile",
+  ["--no-auto-compile",
+   "-L",
+   "/gnu/store/xhwmxry8kkmq7897558qmcmfsx8r1z45-module-import",
+   "/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
+  [("GUILE_LOAD_COMPILED_PATH","/gnu/store/r7sf4w2wwrbxbcf04pi9a5gkdhzaya2g-module-import-compiled"),
+   ("out","")]
+)

+ + +

+ +

$ guix build --derivations hello
+/gnu/store/1drc59xkcvgdphzgylxm41ln9p5dwbgn-hello-2.10.drv

+ +

Derive(
+  [("out","","","")],
+  [("04fb79c7338393b15562c5ffd222b40fb745683896789ad2b37659ac9d597540",["out"]),
+   ("08a81b5317696b0ac342330b4561409db5db8273fee477c26cd2854499e4be1c",["out"]),
+   ("0fcc386963a58070aacfc0cfb4fa5e67e676b25b6b038ed1aa61f12b933a39c3",["out"]),
+   ("1b6c42938b2a02480294d8e89bf9fe94c77f392fd41f7cdb72b4c85071b3d197",["out"]),
+   ("1e8dc40cc0593bae81806df0a1785582fb94ee07802b095ad521e7cb0dd16c41",["out"]),
+   ("2e25667c193bed7410ca1f675ba717d5aec59123392d14b35d0918287de2fdf4",["out"]),
+   ("3266b64f962b87ed7bb437ddd49c33a20d439e049a3829e2c10f5c2d8ae7d294",["out"]),
+   ("39ea9f7baeee4ba446ebbaed88b5354adc088dae479e73a2825471c07088a86c",["out"]),
+   ("522962e0ca0c7a5682ee561e618c9e08ce841d24468125c203e935ecd0e8da37",["out"]),
+   ("523610101af5dc2481bdce53a050d680bbc516c64baf32463cf95ab3b18aa261",["out"]),
+   ("5d7766754e92a0a96ca3b732ae0d9e3da892994961cee1500d7c689a0ddcb785",["out"]),
+   ("61fd1308247835184ffe88140f9025117edb3210c47d617feafa33572ad8b8e3",["out"]),
+   ("6ae6f3630665d92a495a4edb0f337fe1884fff9e6adcef65cf1c79131071d127",["out"]),
+   ("7b8ef27665067602e4e27e801c6e8f385bd83b378037a60a4f5953a02b12c74f",["out"]),
+   ("81c2221261670003975a89df35fba774c3871f4444c0d3a1eef6ef21e7aba678",["out"]),
+   ("875b4153b80df041b31b6d0fb93b4bb8b62fbd3938320a8ce6ff263d01b3a536",["out"]),
+   ("89e81aee370115bec522ad48de0f59030f227fe8a599bb409352a34e710669f8",["out"]),
+   ("a127853978c101a2b52071108ed48834435c0bbaf1b707c13304ef9d8e70c3a6",["out"]),
+   ("ab4bf18925deebcc80259b45cba39b348320a03f61d93e2246dcd6f5d28a1b68",["out"]),
+   ("afe40de343b27326b5e6089c8adf8fdbdb105dcc35f671025c87de0bba965184",["out"]),
+   ("bc726d150b4ba6aa8624eba59ad092d729705de4f0148391d33dac15a8aa5dbf",["out"]),
+   ("bfb16f9021e341594cfce1c772ccd491599694460ac1df24a8bb77fadc2a4a04",["out"]),
+   ("e226a8e968c6132524948d4fd0483a16603b57bddc92f97d6ce31580889754c2",["out"]),
+   ("f662215314a37fcf8ae79e425bd197b3a3351bd8ff3d90506cc069c83c833b6d",["out"])],
+  ["/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
+   "x86_64-linux",
+   "/gnu/store/d8gkn84yqacjr80pzicz1ka3y2s1f2x0-guile-2.2.2/bin/guile",
+  ["--no-auto-compile",
+   "-L",
+   "/gnu/store/xhwmxry8kkmq7897558qmcmfsx8r1z45-module-import",
+   "/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
+  [("GUILE_LOAD_COMPILED_PATH","/gnu/store/r7sf4w2wwrbxbcf04pi9a5gkdhzaya2g-module-import-compiled"),
+   ("out","")]
+)

+ + +

+ This is now what is actually hashed, just without any + formatting. + + (Next) + + The key parts are the hashes of all the input derivations. + + (Next) + + The description of the build process. + + (Next) + + And finally, the environment variables. + + (Next) + + When this derivation is handed over to the build daemon, + it will run the build process in an isolated + environment. The build process will only be able to read + from the areas of the store that are inputs to the + derivation. It will also only be able to write to the + specified output locations. + + Network access is disabled, to ensure that the process + isn't able to access the network, avoiding the possibility + that it depends on something via the network. +

+ +


+            $ guix build --derivations hello
+/gnu/store/1drc59xkcvgdphzgylxm41ln9p5dwbgn-hello-2.10.drv
+

+ +


+            Derive(
+  [("out","/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10","","")],
+  [("/gnu/store/0gabs9i1zawd406rkkr7l15ifg61s34r-glibc-2.25.drv",["out"]),
+   ("/gnu/store/1lqw4mz8xzjhnb65kc1nvk8wg39spv5j-hello-2.10.tar.gz.drv",["out"]),
+   ("/gnu/store/1vmhamqwgs3qa7rw28am5rm3b9fjs163-file-5.30.drv",["out"]),
+   ("/gnu/store/23h9fzinl5j1s5x7r2i155f1m7ify9wl-ld-wrapper-0.drv",["out"]),
+   ("/gnu/store/3li1y3cc8rkr4d0q9h8bkvl4h3macnf6-bash-minimal-4.4.12.drv",["out"]),
+   ("/gnu/store/6y5h0pbqci67ql1ij5crkchjzmxkafbv-gawk-4.1.4.drv",["out"]),
+   ("/gnu/store/8xmbpyfnh5cdrk9fmx8j67894bq9vl1r-module-import.drv",["out"]),
+   ("/gnu/store/9sahk6fh2p5k631rxl6amx0cd4z8jn0s-diffutils-3.6.drv",["out"]),
+   ("/gnu/store/cm2f8yxfpy353kxbq5gl7whzvmkl9niv-make-4.2.1.drv",["out"]),
+   ("/gnu/store/fqx5lcb8lhdxkw1dwcgahnqaxgaycgb1-tar-1.29.drv",["out"]),
+   ("/gnu/store/i5fzg4cq88yvl2i7bsnqprzgq494bpdm-patch-2.7.5.drv",["out"]),
+   ("/gnu/store/iwzysdzl3yphqa0c0km8liiimcsrxmvd-glibc-utf8-locales-2.25.drv",["out"]),
+   ("/gnu/store/jwsvpyyxkmyg0wk3cic3b9q9wgimphkz-findutils-4.6.0.drv",["out"]),
+   ("/gnu/store/m5kd44n51ns8zlc8mvii497xc2siydpb-coreutils-8.27.drv",["out"]),
+   ("/gnu/store/pjgbs80jhzpm7lfpsa5dp6jgxkcv6n56-bzip2-1.0.6.drv",["out"]),
+   ("/gnu/store/qgcr4gp3qz098yh6zsnn97dg4h8d2nbn-sed-4.4.drv",["out"]),
+   ("/gnu/store/r49cqbngzhn8q1qr6cjsm4vs85vwzl9i-xz-5.2.2.drv",["out"]),
+   ("/gnu/store/rkjydj936a096s70bxq7sz77bbxzfqvd-gzip-1.8.drv",["out"]),
+   ("/gnu/store/vk9xdybvknvnnaxavdk2q43yvdq5h47r-binutils-2.28.drv",["out"]),
+   ("/gnu/store/wrlssahrl79njwzwv8clcq8vdh2syppx-module-import-compiled.drv",["out"]),
+   ("/gnu/store/xz5ikvwa6pyz11h0a5hmzf9rxyi5xjzw-guile-2.2.2.drv",["out"]),
+   ("/gnu/store/zb0wzrfgiydmr8gbxywyrmg6yp68w4fj-linux-libre-headers-4.4.47.drv",["out"]),
+   ("/gnu/store/zxiy6cnd05p90hmyk1mvr30lm17ghwim-grep-3.0.drv",["out"]),
+   ("/gnu/store/zxkwsk4g0m7j2p54l7xp2gblb6v4zddf-gcc-5.4.0.drv",["out"])],
+  ["/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
+   "x86_64-linux",
+   "/gnu/store/d8gkn84yqacjr80pzicz1ka3y2s1f2x0-guile-2.2.2/bin/guile",
+  ["--no-auto-compile",
+   "-L",
+   "/gnu/store/xhwmxry8kkmq7897558qmcmfsx8r1z45-module-import",
+   "/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
+  [("GUILE_LOAD_COMPILED_PATH","/gnu/store/r7sf4w2wwrbxbcf04pi9a5gkdhzaya2g-module-import-compiled"),
+   ("out","/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10")]
+)
+

+ + +

+ +

Fixed-output derivation

$ guix build -S -d hello
+/gnu/store/1lqw4mz8xzjhnb65kc1nvk8wg39spv5j-hello-2.10.tar.gz.drv

+ +

Derive(
+  [("out",
+    "/gnu/store/hbdalsf5lpf01x4dcknwx6xbn6n5km6k-hello-2.10.tar.gz",
+    "sha256",
+    "31e066137a962676e89f69d1b65382de95a7ef7d914b8cb956f41ea72e0f516b")],
+  [],
+  ["/gnu/store/qivc6nybj6mxa95h7h10hg7qv81rdfcm-mirrors",
+   "/gnu/store/wvbspgpk15aq6kcf2f67xjai1fbkbyqc-content-addressed-mirrors"],
+  "x86_64-linux",
+  "builtin:download",
+  [],
+  [("content-addressed-mirrors","/gnu/store/wvbspgpk15aq6kcf2f67xjai1fbkbyqc-content-addressed-mirrors"),
+   ("impureEnvVars","http_proxy https_proxy LC_ALL LC_MESSAGES LANG COLUMNS"),
+   ("mirrors","/gnu/store/qivc6nybj6mxa95h7h10hg7qv81rdfcm-mirrors"),
+   ("out","/gnu/store/hbdalsf5lpf01x4dcknwx6xbn6n5km6k-hello-2.10.tar.gz"),
+   ("preferLocalBuild","1"),
+   ("url","\"mirror://gnu/hello/hello-2.10.tar.gz\"")]
+)

+ + +

+ +

+ + Derivation graph for the hello package + + +

+ Here is the bigger picture. This is the graph of + derivations, both with fixed output and non-fixed output + derivations. + + If you can make it out, the fixed output derivations are + in black, and the other derivations are in purple. + + The fixed output derivations tend to sit around the edge + of the graph, as they describe the building blocks used in + the other derivations. + + Fixed output derivations are used to describe the source + code of software, e.g. a source tarball or git repository + checkout. + + There are also bootstrap binaries in the graph. You can't + just go from source code, with no compiler, to compiling a + compiler, so Guix includes some bootstrap binaries to get + started with. + + Other fixed output derivations include patches that are + applied to source code, the build scripts, and Guile + modules that are used in the build scripts. + + This graph also includes the Guix bootstraping process, + for getting from the bootstrap binaries, to GNU hello, and + everything in between. + + Also, thinking back to what goes in to the hash for the + outout of a derivation, that is the hashes of the input + derivations, the build process and environment variables + for non-fixed output derivations, and the output name, + hash algorithm and value for fixed output derivations, we + can now start to look at when changes happen in this + graph, what will happen to the outputs for derivations. + + For exapmle, if you were to change the source code for the + hello package, that would mean that the hash would be + different, therefore the hash of the fixed output + derivation would be different. As that hash is part of the + hash of the hello derivation, its hash would change as + well. + + Comparing this with a Debian package for example, which + would always produce /usr/bin/hello, regardless of the + source code, the way that the derivations output is + computed means that having hello in the store twice just + works. + + While I think it can be useful to understand these low + level details, Guix provides software and tooling to make + it easy to manage and manipulate derivations, using higher + level concepts like packages, build systems and more. +

+ +

The hello package

+ +

+            (define-public hello
+  (package
+    (name "hello")
+    (version "2.10")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/hello/hello-" version
+                                  ".tar.gz"))
+              (sha256
+               (base32
+                "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"))))
+    (build-system gnu-build-system)
+    (synopsis "Hello, GNU world: An example GNU package")
+    (description
+     "GNU Hello prints the message \"Hello, world!\" and then exits.  It
+serves as an example of standard GNU coding practices.  As such, it supports
+command-line arguments, multiple languages, and so on.")
+    (home-page "https://www.gnu.org/software/hello/")
+    (license gpl3+)))

+ + +

+ +

What can you do with Guix?

+ + +

+ +

Install a package in to your profile

+ +


+            guix package -i hello
+

+ + +

+ +

Upgrade the packages in your profile

+ +


+            guix package -u
+

+ + +

+ +

Roll back to the previous generation of your profile

+ +


+            guix package --roll-back
+

+ + +

+ +

guix package -i samtools bowtie

+ + Modified, © Ricardo Wurmus + + +

+ Obviously, knowing this isn't required to use the commands + I just mentioned, but this is a technical talk, so lets go + through the details. + + Normally, you'd have a .guix-profile symlink in your home + directory. + + This symlink then points to a file in /var/guix + representing the current version of the profile. + + This file is also a symlink, which links to a file in the + same directory. The name of this file is a number, which + is the generation of the profile. + + This numbered file, in this case 42, is yet another + symlink. This symlink finally points to the profile within + the store. + + Profiles in the store are a way of composing packages. A + profile contains symlinks to other packages in the store, + in a convenient directory structure, e.g. all of the files + in the /bin directory within packages end up in the /bin + directory of the profile. +

+ +

guix package -r bowtie

+ + Modified, © Ricardo Wurmus + + + +

+ +

guix package --roll-back

+ + Modified, © Ricardo Wurmus + + + +

+ +

Wait a minute, what was installed?

+ + +

+ +


+            guix package -i hello
+

+ +

+ What did this actually install? + + While this may look ambiguous, just install hello, it + actually ends up being rather specific. + + The instruction here to install hello will match a + specific package. If there are multiple packages with the + name hello, then the version can be used to + disambiguate. By default, Guix will pick the highest + version. + + The package describes everything about how to build that + software, all the way down to the bootstrap binaries. + + (Next) + + When you install hello, you specify hello built through + the process described in this diagram. Now I guess most + users of guix will fetch a binary substitute for the hello + package, and any dependencies they need, rather than going + through the process of building it. + + All of this means that Guix gives you the means to get a + high degree of reproducibility and determinism when using + software. + + There is no guarantee that the output will be identical + bit for bit, but that is something that the Guix project + is working towards, along with other people and projects + in the free software community. + + There is however a guarantee that the process will be + identical. + + The hello package isn't a very good example of this, but + imagine a more complicated scenario, some software with + many more dependencies and complexity. + + There is a danger with some approaches that as you make + changes, other changes occur because of a lack of + reproducibility. + + With Debian for example, unless you are quite careful with + the versioned dependency constraints and the available + packages, there is a potential for new versions of + software to creep in from repositories that you're using. + + With Guix, providing you are using the same package + definitions, you'll get the same reproducible process when + building your software. + + + +

+ +


+guix environment hello
+

+ + +

+ +


+            guix environment --ad-hoc hello guile
+

+

+

/gnu/store/5w8jk6p57l5an1d39lngw560r2bw2dx1-profile/bin
+├── guild -> /gnu/store/yih…6fk-guile-2.2.2/bin/guild
+├── guile -> /gnu/store/yih…6fk-guile-2.2.2/bin/guile
+├── guile-config -> /gnu/store/yih…6fk-guile-2.2.2/bin/guile-config
+├── guile-snarf -> /gnu/store/yih…6fk-guile-2.2.2/bin/guile-snarf
+├── guile-tools -> /gnu/store/yih…6fk-guile-2.2.2/bin/guile-tools
+└── hello -> /gnu/store/wf6…2sx-hello-2.10/bin/hello

+ + +

+ +


+            guix environment --pure --ad-hoc hello
+

+ + +

+ +


+            guix environment --container --ad-hoc hello
+

+ +
+

$ echo /gnu/store/*
+/gnu/store/…-ncurses-6.0      /gnu/store/…-profile
+/gnu/store/…-manual-database  /gnu/store/…-gcc-5.4.0-lib
+/gnu/store/…-info-dir         /gnu/store/…-bash-4.4.12
+/gnu/store/…-readline-7.0     /gnu/store/…-glibc-2.25
+/gnu/store/…-hello-2.10       /gnu/store/…-bash-static-4.4.12

+ +

+ You can do more for isolation through. + + The guix environment command has a neat --container + argument. + + This means that the subshell you enter will be in a new + mount, pid, ipc, uts, user and network namespace. + + The new mount namespace only gives the environment access + to the store items that are needed, some default other + directories, as well as the current working directory. + + Here, I'm using echo to show the files in the store. I + can't use ls, but coreutils isn't in this + environment. What is show here is the minimal set of + packages required to run hello, and also the bash shell in + which the echo command is running. + + Now, this is only possible because the information about + the complete dependencies needed to run hello which are + stored in the database accompanying the store. +

+ +

+ + Graph of the hello package references + + +

+ +

$ ldd /gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10/bin/hello
+
+linux-vdso.so.1 (0x00007ffece166000)
+libgcc_s.so.1 => /gnu/store/3x53yv4v144c9xp02rs64z7j597kkqax-gcc-5.4.0-lib/lib/libgcc_s.so.1 (0x00007fee83076000)
+libc.so.6 => /gnu/store/n6nvxlk2j8ysffjh3jphn1k5silnakh6-glibc-2.25/lib/libc.so.6 (0x00007fee82cd7000)
+/gnu/store/n6nvxlk2j8ysffjh3jphn1k5silnakh6-glibc-2.25/lib/ld-linux-x86-64.so.2 (0x00007fee8328d000)

+ +

+ Lets take a deeper look. + + When the hello store item references the gcc and glibc + store items, it literally contains references to those + directories in the binary. + + If you use the ldd command to show the shared libraries + that are linked against, then you see the exact paths + being specified. + + This is good for a number of reasons. + + From a reliability point of view, this helps, as hello is + going to be consistent in the shared libraries that it + loads. This particular way of using shared libraries, as + well as other approaches to have store items reference + each other is one of the tools packages in guix use to + make the software less vulnerable to change and breakages. + + Another benefit of this is that you are still doing + dynamic linking. I've heard of people not using dynamic + linking, and statically linking executables to get some of + the same benefits that Guix provides, but statically + linked binaries can consume more disk and memory space, + Guix I think gives you the best of both worlds, reliable + dynamic linking. +

+ +

Guix + Direnv

+

+ +


+            use guix --ad-hoc gcc-toolchain python python-lxml
+

+

+ +


+            $ cd /tmp/foo
+direnv: loading .envrc
+direnv: using guix --ad-hoc gcc-toolchain python python-lxml
+direnv: export +PAGER +PYTHONPATH ~CPLUS_INCLUDE_PATH
+               ~C_INCLUDE_PATH ~LIBRARY_PATH ~PATH
+

+ + +

+ +

Managing systems and services with Guix

+ + +

+ +

Systems

+ +

(use-modules (gnu))
+(use-service-modules networking ssh)
+(use-package-modules screen ssh)
+
+(operating-system
+  (host-name "komputilo")
+  (timezone "Europe/Berlin")
+  (locale "en_US.utf8")
+
+  (bootloader (bootloader-configuration
+                (bootloader grub-bootloader)
+                (target "/dev/sdX")))
+  (file-systems (cons (file-system
+                        (device "my-root")
+                        (title 'label)
+                        (mount-point "/")
+                        (type "ext4"))
+                      %base-file-systems))
+
+  (users (cons (user-account
+                (name "alice")
+                (comment "Bob's sister")
+                (group "users")
+                (supplementary-groups '("wheel"
+                                        "audio" "video"))
+                (home-directory "/home/alice"))
+               %base-user-accounts))
+
+  (packages (cons* screen openssh %base-packages))
+
+  (services (cons* (dhcp-client-service)
+                   (service openssh-service-type
+                            (openssh-configuration
+                              (port-number 2222)))
+              %base-services)))

+ +

+ Currently when using GuixSD, you'll probably be using a + configuration file for the system. Here is a modified + version of the bare bones example included within Guix. + + This specification allows you to declare a whole load of + different things about your system, the filesystems, + users, packages, services and more. + + When using GuixSD, the filesystem is a bit different from + other distributions. + + You don't by default have a /usr directory. As Guix + manages packages in per user profiles, with the addition + of a system profile, managing a stateful /usr directory + would possibly impact some of the advantages that Guix + brings. + + That doesn't mean you can't have stateful files in /usr + though, on this laptop I have /usr/bin/env and + /usr/share/zoneinfo, as that helps with some software that + I use. + + Another point to mention about GuixSD is how changes to + this configuration work. + + Changes work similar to the changes to package profiles, + there are generations of the system in /var/guix/profiles, + and to apply a change in the configuration to a system, + you reconfigure the system to use that configuration. + + This process generates the new system state, and then + switches to it as atomically as possible. This, along with + the ability to boot in to previous generations of the + system make GuixSD very reliable. + + Generations of the system don't only include Linux, but + other components of the system like services and file + system configuration. + + I really like this. For example, I reconfigured this + laptop yesterday, save in the knowledge that if anything + went wrong, I could just boot in to the previous + generation of my system. + + Compared to other ways I've managed systems, I think using + Guix has a lot of advantages. + + The broad way in which Guix manages the system + configuration, and does so as a proper feature set it + apart from other systems I've used, like Ansible and + Puppet, where you attempt to converge some system to the + desired state, and usually specify more about what you + want, than what you don't, which can leave room for + systems to become inconsistent in bad ways. + + I'm also enjoying not having to convince apt to untangle + Debian systems that I've broken when trying to upgrade. +

+ +

Services

+ +

...
+
+  (services (cons* (dhcp-client-service)
+                   (service openssh-service-type
+                            (openssh-configuration
+                              (port-number 2222)))
+                   %base-services)))

+ + +

+ One important part of GuixSD is the services. + + Guix packages are usable on other systems, however + services are specific to GuixSD. + + They are similar though, in that they are both described + through values in Guile. + + I won't go in to writing service definitions here, though + it is something that I quite enjoy doing. + + There are quite a few examples in Guix at the moment, so + you might be able to get a feel for them by looking at the + documentation and the source code. + + Guix services can cooperate together by a process called + service extension. For example, services that describe a + daemon extend the root shepherd service, passing across + the details of the service they want to provide. +

+ +

+ Extension graph + + +

+ +

+ Shepherd graph + + +

+ +

+ Extending Guix +

+ + +

+ +

Writing a package definition

+ +

+ Importers available for: gnu, nix, pypi, cpan, hackage, + stackage, elpa, gem, cran, crate, texlive and json. +

+ + +

+ +

Hello package definition

+ +

+            (define-public hello
+  (package
+    (name "hello")
+    (version "2.10")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/hello/hello-" version
+                                  ".tar.gz"))
+              (sha256
+               (base32
+                "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"))))
+    (build-system gnu-build-system)
+    (synopsis "Hello, GNU world: An example GNU package")
+    (description
+     "GNU Hello prints the message \"Hello, world!\" and then exits.  It
+serves as an example of standard GNU coding practices.  As such, it supports
+command-line arguments, multiple languages, and so on.")
+    (home-page "https://www.gnu.org/software/hello/")
+    (license gpl3+)))

+ + +

+ +

Inheritance

+ +

(define-public ruby-2.3
+  (package
+    (inherit ruby)
+    (version "2.3.5")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://cache.ruby-lang.org/pub/ruby/"
+                           (version-major+minor version)
+                           "/ruby-" version ".tar.xz"))
+       (sha256
+        (base32
+         "1npzcnq5kh0f9y88w5gj4v6ln8csr91361k3r43dmhlhn6mpsfkx"))
+       (modules '((guix build utils)))
+       (snippet `(begin
+                   ;; Remove bundled libffi
+                   (delete-file-recursively "ext/fiddle/libffi-3.2.1")
+                   #t))))))

+ + +

+ +

G-expressions, a way of staging code

+ +

(define build-exp
+  #~(begin
+      (mkdir #$output)
+      (chdir #$output)
+      (symlink (string-append #$coreutils "/bin/ls")
+               "list-files")))

+ + +

+ +

What is Guix?

+ + + Standalone package definitions
+ bootstrap binaries +

+ Package management tool + library

+ + GNU+Linux distribution, with declarative
configuration for + the system and services +

+ + + Build packages from source, offload build tasks to other + machines, copy store items to other machines, graph + packages and systems, inspect the size of store items, + publish substitutes, run the garbage collector, generate + package definitions from various sources, update package + definitions for new releases, build raw or ISO disk + images... + + + +

+ Given all of this, the question "what is Guix?" isn't very + easy to give a single answer to. + + (Next fragment) + + One aspect of Guix is the standalone package definitions, + and the bootstrap binaries. Together providing a stable, + controllable and inspectable set of software which you can + use directly, and also use as a stable foundation to build + upon. + + (Next fragment) + + Along with this, Guix has tooling to make use of the + package definitions, providing a number of different ways + in which to use them. + + From the guix package command, to manage persistent + profiles, to the guix environment command to create more + temporary profiles and development environments, to the + guix pack command, which allows you to take packages and + pack them up in different ways, currently a tarball and + Docker image also known as the Open Container Initiative + image format. + + Even more functionality and flexibility is available if + you need it, by directly using Guix as a library. + + (Next fragment) + + On top of all of this, Guix provides and brings together + the software and tooling you need to setup a GNU+Linux + distribution, a.k.a GuixSD, the Guix system distribution. + + The state of the system can be specified in a declarative + way, from the user accounts, to the file systems, to the + configuration for many services like PostgreSQL, OpenSSH, + MongoDB, nginx, Dovecot and many more. + + Using the same approaches as for packages and profiles, + this offers roll backs for the system profile, not only + switching back to a previous version of Linux if + applicable, but other parts of the system as well. + + To complement this, Guix includes the tooling for systems + to generate disk images, system containers and virtual + machines, all from a operating system definition. + + (Next fragment) + + And then come all the smaller features, that I think still + make a big difference. + + Building packages from source is seemless, just change the + package definition, and then use it. If you need to change + a dependency of the package you care about, or a + dependency of a dependency of a package you care about, + then its no different. + + Build tasks can be offloaded to other machines. You can + generate graphs for packages, showing the inputs, and + their inputs, and so on. + + The guix size command will show you the references of a + store item, along with their size. + + The guix publish command and service can be used to + publish binary substitutes, for use on other machines. The + guix gc command invokes the garbage collector allows you + to remove unused items from the store, freeing up disk + space. + + The guix import command can generate package definitions + from various sources like the Python package index, + Rubygems.org, CPAN, Hackage, Stackage, Elpa and more. + + The guix refresh command can for some packages update the + package definitions, by checking for new releases. + + And... there is probably even more things that I've + missed, and I haven't even covered any of the tooling that + people have built that uses or enhances Guix. +

+ +

Use Guix!

+ +

+ Install Guix within an existing system. +

+ +

+ Install GuixSD, a distribution of GNU+Linux. +

+ +

+ If you are going to directly benefit from all of this, + then there are a few different ways of using Guix. + + You can use it within a existing system. The Linux and + Hurd kernels are supported, and Guix has been ported to + the x86 64, i686 and armhf architectures. + + Due to the way Guix works, it's very isolated from the + system its installed on. By default, just requiring two + directories, /gnu and /var/guix and the build daemon to be + running. + + With Guix installed within an existing system, you can + create system containers, virtual machines, but to take + full advantage of features such as the declarative system + configuration, you'll need to install GuixSD. +

+ +

Talk to others on

#guix on freenode

+ +

+ For the manual, mailing lists, papers, blog posts and + talks, go to + + https://gnu.org/s/guix/help + +

+ +

GNU Guix

Package manager, system distribution and more…

+ Guix... +

+ Why another package management tool? +

UserControl / Freedom

How does Guix work?

1993

2004

2012

2017

The store

Fixed-output derivation

The hello package

What can you do with Guix?

Install a package in to your profile

Upgrade the packages in your profile

Roll back to the previous generation of your profile

Wait a minute, what was installed?

Guix + Direnv

Managing systems and services with Guix

Systems

Services

+ Extending Guix +

Writing a package definition

Hello package definition

Inheritance

G-expressions, a way of staging code

What is Guix?

Use Guix!

Talk to others on

#guix on freenode

Package manager,
system distribution
and more…

User
Control / Freedom