[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Reproducible installation images
From: |
Ludovic Courtès |
Subject: |
Re: Reproducible installation images |
Date: |
Tue, 12 Dec 2017 10:27:46 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) |
Mark H Weaver <address@hidden> skribis:
> address@hidden (Ludovic Courtès) writes:
>
>> Mark H Weaver <address@hidden> skribis:
>>
>>> address@hidden (Ludovic Courtès) writes:
>>>
>>>> Here are the bootable USB installation images and their signatures[*]:
>>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.i686-linux.iso.xz
>>>>
>>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.i686-linux.iso.xz.sig
>>>>
>>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.x86_64-linux.iso.xz
>>>>
>>>> https://alpha.gnu.org/gnu/guix/guixsd-install-0.14.0.x86_64-linux.iso.xz.sig
>>>>
>>>> Here is the QCOW2 virtual machine (VM) image and its signature:
>>>> https://alpha.gnu.org/gnu/guix/guixsd-vm-image-0.14.0.x86_64-linux.xz
>>>>
>>>> https://alpha.gnu.org/gnu/guix/guixsd-vm-image-0.14.0.x86_64-linux.xz.sig
>>>>
>>>> Here are the binary tarballs and their signatures[*]:
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.i686-linux.tar.xz
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.i686-linux.tar.xz.sig
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.x86_64-linux.tar.xz
>>>>
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.x86_64-linux.tar.xz.sig
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.armhf-linux.tar.xz
>>>>
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.armhf-linux.tar.xz.sig
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.aarch64-linux.tar.xz
>>>>
>>>> https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.aarch64-linux.tar.xz.sig
>>>
>>> To enable independent verification of these installer images, it would
>>> be helpful to include the precise commands needed to reproduce these
>>> images, and the git commit to run them on.
>>>
>>> What do you think?
>>
>> The manual already gives those commands:
>>
>>
>> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
>> (bottom)
>>
>> https://www.gnu.org/software/guix/manual/html_node/Building-the-Installation-Image.html
>
> They give the commands, but they do not provide the git commit that you
> ran these commands on.
True. So the announcements could say something like:
See the “Binary Installation” and “Building the Installation Image”
sections of the manual on how to recreate these binary images. The
‘guix-binary’ tarballs were created from the ‘v0.14.0’ Git tag; the
‘guixsd-’ images were created from the tip of the ‘version-0.14.0’
branch.
Or maybe give the ‘git checkout/guix build’ sequence of commands?
Thoughts?
Ludo’.