On 20-07-2022 17:03, phodina wrote:
Toggle quote (15 lines)
>
> OK, though then this is a draft patch that's blocked by supporting
> gradle and Android; Guix is a build-from-source distro (there are
> some bootstrap seeds, but the idea is to reduce them, not enlarge
> them).
>
> I understand that the aim is to reduce the prebuild stuff not vice
> versa that's why I labeled it here. One solution could be to replace
> the location by specifying some env variable and the user would supply
> either the prebuild version from the repo or build it themself e.g. in
> Docker.
>
> This way the package would not have any prebuild files. Would that be
> okay?
>
The package would not have prebuild files, but the user will have to
download some prebuild files anyway, so effectively the problem of
prebuild files remains (the user has to trust some random download
location to have an unbackdoored binary, that they can not inspect, and
while they can modify the source code, it's useless because they can't
compile it; Guix cannot exercise freedom 1).
Also, one of the primary tasks of a package manager is to keep track of
dependencies, automatically installing the (non-optional) dependencies,
which seems incompatible with telling a user to grab a dependency from
outside the package manager.
As such, I believe this not to be okay, and that it is required to make
gradle & Android things functional first.
Greetings,
Maxime.