Re: Profiles/manifests-related command line interface enhancements

[Ludovic Courtès]

Hi Konrad,

Konrad Hinsen <address@hidden> skribis:

> YAML is for kids. Real managers won't settle for less than full XML. ;-)
>
> Seriously, as a power user, I am perfectly happy with Guile for
> everything. I certainly don't want less. And for now, it's safe to
> assume that most Guix users are power users. The question is if we want
> Guix to remain exclusively a power tool for power users.

I’d like to think that writing Guile declarations for the OS config,
manifest, etc. is not just for “power users”.  After all people, or
rather “computer-savvy” people in a broad sense, write JSON, YAML,
custom config files etc. routinely, and I don’t think the typical config
we propose is any “harder”.  You may say I’m a dreamer, but I’m not the
only one. 𝅗𝅥𝅘𝅥  ;-)

> If not, we need to make sure that it won't become a malware platform,
> by making it safe to use for people who don't read Guile code. In
> particular, common use cases should not require users do download
> unrestricted Guile code from untrusted sources.

Definitely!

I think we need to focus on specific scenarios though.

For example, when you add a channel to ~/.config/guix, you’ll end up
running its unrestricted Guile code as soon as ‘guix pull’ is done.
However, independently of that, you’ll most likely be installing
packages defined in that channel, and then running them unrestricted.
IOW, users of a channel have to trust it to not be malicious, regardless
of the fact that its Guile code runs unrestricted.

For manifests shared over the net, the situation may be different: a
manifest could refer to packages in the channels you trust, and thus
there’s value in not having to trust the manifest code itself.

It’s still a bit too abstract, but for the purposes of sharing and
publishing “super packages” as you wrote, we could define a
purely-declarative format (could be JSON, could be Guile code that can
run under (ice-9 sandbox) or with ‘eval/container’) that people could
use instead unrestricted as is currently the case.

Thanks,
Ludo’.