Re: Reproducible installation images

[Ludovic Courtès]

Mark H Weaver <address@hidden> skribis:

> address@hidden (Ludovic Courtès) writes:
>
>> Mark H Weaver <address@hidden> skribis:
>>
>>> address@hidden (Ludovic Courtès) writes:
>>>
>>>>   Here are the bootable USB installation images and their signatures[*]:
>>>>     https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.i686-linux.iso.xz
>>>>     
>>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.i686-linux.iso.xz.sig
>>>>     
>>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.x86_64-linux.iso.xz
>>>>     
>>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.x86_64-linux.iso.xz.sig
>>>>
>>>>   Here is the QCOW2 virtual machine (VM) image and its signature:
>>>>     https://alpha.gnu.org/gnu/guix/guixsd-vm-image-0.14.0.x86_64-linux.xz
>>>>     
>>>> https://alpha.gnu.org/gnu/guix/guixsd-vm-image-0.14.0.x86_64-linux.xz.sig
>>>>
>>>>   Here are the binary tarballs and their signatures[*]:
>>>>     https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.i686-linux.tar.xz
>>>>     https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.i686-linux.tar.xz.sig
>>>>     https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.x86_64-linux.tar.xz
>>>>     
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.x86_64-linux.tar.xz.sig
>>>>     https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.armhf-linux.tar.xz
>>>>     
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.armhf-linux.tar.xz.sig
>>>>     https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.aarch64-linux.tar.xz
>>>>     
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.aarch64-linux.tar.xz.sig
>>>
>>> To enable independent verification of these installer images, it would
>>> be helpful to include the precise commands needed to reproduce these
>>> images, and the git commit to run them on.
>>>
>>> What do you think?
>>
>> The manual already gives those commands:
>>
>>   
>> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html 
>> (bottom)
>>   
>> https://www.gnu.org/software/guix/manual/html_node/Building-the-Installation-Image.html
>
> They give the commands, but they do not provide the git commit that you
> ran these commands on.

True.  So the announcements could say something like:

  See the “Binary Installation” and “Building the Installation Image”
  sections of the manual on how to recreate these binary images.  The
  ‘guix-binary’ tarballs were created from the ‘v0.14.0’ Git tag; the
  ‘guixsd-’ images were created from the tip of the ‘version-0.14.0’
  branch.

Or maybe give the ‘git checkout/guix build’ sequence of commands?

Thoughts?

Ludo’.