GNU Guix

Package manager,
system distribution
and more…

Hello, my name is Chris, and we're going to take a look at a software project called GNU Guix. Before we begin, hands up if you're excited about package managers? I'd prefer to cover only some of the material I've got, really well, rather than cover all of it badly, so please interrupt, and jump in with questions as and when they come to you. I've not planned any live demos explicitly, but I'm using GuixSD on this laptop, and am happy to attempt to demo stuff. I first found out about Guix sometime in late 2015, early 2016. I remember installing it the night before FOSDEM, a free software conference in Brussles, back in January 2016. At FOSDEM that year there were many talks about Guix in the GNU Guile devroom. I started using and contributing to Guix soon after. Maybe some of you are using Guix already, maybe some of you have heard of it, but don't know much about it, and maybe some of you haven't heard of Guix before freenode live. In any case, I hope most of you will learn something about Guix in the next hour. I'm going to try and cover: - some of the technical fundamentals - how you can use guix as a package manager - how you can use Guix to manage systems and services - and finally, ways in which you can extend Guix

Guix...

Why another package management tool?

User
Control / Freedom

Installing software is something which I think has been getting easier, and better. Package managers have helped a lot with this, but often there is still room for improvement. Sometimes, package managers have the option to install software without building it from source by fetching some corresponding binary package. But you may want to build the software from source anyway, and this can be tricky. There can be a few reasons for building from source. There might not be a corresponding binary package available, you might want to not have to trust the available binary packages, or you may want to modify the software, patching a security vulnerability for example. Also, when installing software, there can be issues with package conflicts. With some package managers, some packages may conflict with others, and some may conflict with different versions of the same package. Making it difficult to meet the needs of multiple pieces of software, or multiple users. Even if you make it through installing software, many people using software are stuck in a world where if they take the risk to remove or upgrade some software on there computer, then something may break. Now, of course, updating software may introduce bugs, but sometimes updating one bit of software can break a related bit of software that wasn't updated. The same goes for installing and removing software, sometimes, unfortunately, some other piece of software needed what was removed, or an existing piece of software conflicts with the newly installed software. On the whole, being able to install software from source, or using prebuilt binary packages, avoiding conflicts between packages, even multiple versions of the same package, and being able to remove or upgrade software, without worrying about causing problems are all issues of user control and user freedom. I think Guix is a tool that can help, so how does it work?

How does Guix work?

1993

First Debian release

2004

Nix: A Safe and Policy-Free System for Software Deployment

2012

Guix announced

2017

freenode #live

At the top, we have Debian. Which started in 1993, and has grown to be a very popular free software distribution. I love Debian. I've used it quite a bit, including writing packages for software and services. If I make any comparisons to it, its not because I think its bad, just that its what I was using, before I began using Guix more and more. A while after the Debian project started, and quite a long time ago now, back in 2004, the first paper on a piece of software called Nix was published. I didn't find out about Nix until I found out about Guix, but Nix is important to mention, as some of the key concepts underlying Guix come from Nix. Around 5 years ago now, the Guix project was started bu Ludovic Courtès, using some of the key ideas from Nix, and adding some more.

The store

/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10
├── bin
│   └── hello
└── share
    ├── info
    │   └── ...
    ├── locale
    │   └── ...
    └── man
        └── ...

We start with the store, a special directory where files, and the outputs from derivations that have been built successfully are stored. When using Guix, the location of the store is /gnu/store. The store contains store items, and there is a database that contains information on these, such as how the store items refer to each other. (Next) Shown here is an example store item. In this case, its a directory, containing GNU Hello. Operations on the store should be performed by the build daemon, which helps ensure that the store is maintained correctly. To protect the integrity of the store, it is useful to make it read only, to everything but the build daemon. (Next) The hash here is really important, and that comes from the derivation which is used to create the store item.


            $ guix build --derivations hello
/gnu/store/1drc59xkcvgdphzgylxm41ln9p5dwbgn-hello-2.10.drv


            Derive(
  [("out","/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10","","")],
  [("/gnu/store/0gabs9i1zawd406rkkr7l15ifg61s34r-glibc-2.25.drv",["out"]),
   ("/gnu/store/1lqw4mz8xzjhnb65kc1nvk8wg39spv5j-hello-2.10.tar.gz.drv",["out"]),
   ("/gnu/store/1vmhamqwgs3qa7rw28am5rm3b9fjs163-file-5.30.drv",["out"]),
   ("/gnu/store/23h9fzinl5j1s5x7r2i155f1m7ify9wl-ld-wrapper-0.drv",["out"]),
   ("/gnu/store/3li1y3cc8rkr4d0q9h8bkvl4h3macnf6-bash-minimal-4.4.12.drv",["out"]),
   ("/gnu/store/6y5h0pbqci67ql1ij5crkchjzmxkafbv-gawk-4.1.4.drv",["out"]),
   ("/gnu/store/8xmbpyfnh5cdrk9fmx8j67894bq9vl1r-module-import.drv",["out"]),
   ("/gnu/store/9sahk6fh2p5k631rxl6amx0cd4z8jn0s-diffutils-3.6.drv",["out"]),
   ("/gnu/store/cm2f8yxfpy353kxbq5gl7whzvmkl9niv-make-4.2.1.drv",["out"]),
   ("/gnu/store/fqx5lcb8lhdxkw1dwcgahnqaxgaycgb1-tar-1.29.drv",["out"]),
   ("/gnu/store/i5fzg4cq88yvl2i7bsnqprzgq494bpdm-patch-2.7.5.drv",["out"]),
   ("/gnu/store/iwzysdzl3yphqa0c0km8liiimcsrxmvd-glibc-utf8-locales-2.25.drv",["out"]),
   ("/gnu/store/jwsvpyyxkmyg0wk3cic3b9q9wgimphkz-findutils-4.6.0.drv",["out"]),
   ("/gnu/store/m5kd44n51ns8zlc8mvii497xc2siydpb-coreutils-8.27.drv",["out"]),
   ("/gnu/store/pjgbs80jhzpm7lfpsa5dp6jgxkcv6n56-bzip2-1.0.6.drv",["out"]),
   ("/gnu/store/qgcr4gp3qz098yh6zsnn97dg4h8d2nbn-sed-4.4.drv",["out"]),
   ("/gnu/store/r49cqbngzhn8q1qr6cjsm4vs85vwzl9i-xz-5.2.2.drv",["out"]),
   ("/gnu/store/rkjydj936a096s70bxq7sz77bbxzfqvd-gzip-1.8.drv",["out"]),
   ("/gnu/store/vk9xdybvknvnnaxavdk2q43yvdq5h47r-binutils-2.28.drv",["out"]),
   ("/gnu/store/wrlssahrl79njwzwv8clcq8vdh2syppx-module-import-compiled.drv",["out"]),
   ("/gnu/store/xz5ikvwa6pyz11h0a5hmzf9rxyi5xjzw-guile-2.2.2.drv",["out"]),
   ("/gnu/store/zb0wzrfgiydmr8gbxywyrmg6yp68w4fj-linux-libre-headers-4.4.47.drv",["out"]),
   ("/gnu/store/zxiy6cnd05p90hmyk1mvr30lm17ghwim-grep-3.0.drv",["out"]),
   ("/gnu/store/zxkwsk4g0m7j2p54l7xp2gblb6v4zddf-gcc-5.4.0.drv",["out"])],
  ["/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
   "x86_64-linux",
   "/gnu/store/d8gkn84yqacjr80pzicz1ka3y2s1f2x0-guile-2.2.2/bin/guile",
  ["--no-auto-compile",
   "-L",
   "/gnu/store/xhwmxry8kkmq7897558qmcmfsx8r1z45-module-import",
   "/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
  [("GUILE_LOAD_COMPILED_PATH","/gnu/store/r7sf4w2wwrbxbcf04pi9a5gkdhzaya2g-module-import-compiled"),
   ("out","/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10")]
)

This is an example derivation for the GNU hello package. Normally, there is no formatting or highlighting, but I've added some here to make it more understandable. (Next) The first thing to notice is the output file, highlighted here in green. It appears twice, the first time is for the build daemon, so it knows what to expect, and the second time is for the builder, so it knows where to put the output. The hash part of the filename is computed by hashing something which looks like this, but not containing the output file, as you haven't computed the hash yet. So lets remove the output file, and look at what goes in to the hash.

$ guix build --derivations hello
/gnu/store/1drc59xkcvgdphzgylxm41ln9p5dwbgn-hello-2.10.drv

Derive(
  [("out","","","")],
  [("/gnu/store/0gabs9i1zawd406rkkr7l15ifg61s34r-glibc-2.25.drv",["out"]),
   ("/gnu/store/1lqw4mz8xzjhnb65kc1nvk8wg39spv5j-hello-2.10.tar.gz.drv",["out"]),
   ("/gnu/store/1vmhamqwgs3qa7rw28am5rm3b9fjs163-file-5.30.drv",["out"]),
   ("/gnu/store/23h9fzinl5j1s5x7r2i155f1m7ify9wl-ld-wrapper-0.drv",["out"]),
   ("/gnu/store/3li1y3cc8rkr4d0q9h8bkvl4h3macnf6-bash-minimal-4.4.12.drv",["out"]),
   ("/gnu/store/6y5h0pbqci67ql1ij5crkchjzmxkafbv-gawk-4.1.4.drv",["out"]),
   ("/gnu/store/8xmbpyfnh5cdrk9fmx8j67894bq9vl1r-module-import.drv",["out"]),
   ("/gnu/store/9sahk6fh2p5k631rxl6amx0cd4z8jn0s-diffutils-3.6.drv",["out"]),
   ("/gnu/store/cm2f8yxfpy353kxbq5gl7whzvmkl9niv-make-4.2.1.drv",["out"]),
   ("/gnu/store/fqx5lcb8lhdxkw1dwcgahnqaxgaycgb1-tar-1.29.drv",["out"]),
   ("/gnu/store/i5fzg4cq88yvl2i7bsnqprzgq494bpdm-patch-2.7.5.drv",["out"]),
   ("/gnu/store/iwzysdzl3yphqa0c0km8liiimcsrxmvd-glibc-utf8-locales-2.25.drv",["out"]),
   ("/gnu/store/jwsvpyyxkmyg0wk3cic3b9q9wgimphkz-findutils-4.6.0.drv",["out"]),
   ("/gnu/store/m5kd44n51ns8zlc8mvii497xc2siydpb-coreutils-8.27.drv",["out"]),
   ("/gnu/store/pjgbs80jhzpm7lfpsa5dp6jgxkcv6n56-bzip2-1.0.6.drv",["out"]),
   ("/gnu/store/qgcr4gp3qz098yh6zsnn97dg4h8d2nbn-sed-4.4.drv",["out"]),
   ("/gnu/store/r49cqbngzhn8q1qr6cjsm4vs85vwzl9i-xz-5.2.2.drv",["out"]),
   ("/gnu/store/rkjydj936a096s70bxq7sz77bbxzfqvd-gzip-1.8.drv",["out"]),
   ("/gnu/store/vk9xdybvknvnnaxavdk2q43yvdq5h47r-binutils-2.28.drv",["out"]),
   ("/gnu/store/wrlssahrl79njwzwv8clcq8vdh2syppx-module-import-compiled.drv",["out"]),
   ("/gnu/store/xz5ikvwa6pyz11h0a5hmzf9rxyi5xjzw-guile-2.2.2.drv",["out"]),
   ("/gnu/store/zb0wzrfgiydmr8gbxywyrmg6yp68w4fj-linux-libre-headers-4.4.47.drv",["out"]),
   ("/gnu/store/zxiy6cnd05p90hmyk1mvr30lm17ghwim-grep-3.0.drv",["out"]),
   ("/gnu/store/zxkwsk4g0m7j2p54l7xp2gblb6v4zddf-gcc-5.4.0.drv",["out"])],
  ["/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
   "x86_64-linux",
   "/gnu/store/d8gkn84yqacjr80pzicz1ka3y2s1f2x0-guile-2.2.2/bin/guile",
  ["--no-auto-compile",
   "-L",
   "/gnu/store/xhwmxry8kkmq7897558qmcmfsx8r1z45-module-import",
   "/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
  [("GUILE_LOAD_COMPILED_PATH","/gnu/store/r7sf4w2wwrbxbcf04pi9a5gkdhzaya2g-module-import-compiled"),
   ("out","")]
)

$ guix build --derivations hello
/gnu/store/1drc59xkcvgdphzgylxm41ln9p5dwbgn-hello-2.10.drv

Derive(
  [("out","","","")],
  [("04fb79c7338393b15562c5ffd222b40fb745683896789ad2b37659ac9d597540",["out"]),
   ("08a81b5317696b0ac342330b4561409db5db8273fee477c26cd2854499e4be1c",["out"]),
   ("0fcc386963a58070aacfc0cfb4fa5e67e676b25b6b038ed1aa61f12b933a39c3",["out"]),
   ("1b6c42938b2a02480294d8e89bf9fe94c77f392fd41f7cdb72b4c85071b3d197",["out"]),
   ("1e8dc40cc0593bae81806df0a1785582fb94ee07802b095ad521e7cb0dd16c41",["out"]),
   ("2e25667c193bed7410ca1f675ba717d5aec59123392d14b35d0918287de2fdf4",["out"]),
   ("3266b64f962b87ed7bb437ddd49c33a20d439e049a3829e2c10f5c2d8ae7d294",["out"]),
   ("39ea9f7baeee4ba446ebbaed88b5354adc088dae479e73a2825471c07088a86c",["out"]),
   ("522962e0ca0c7a5682ee561e618c9e08ce841d24468125c203e935ecd0e8da37",["out"]),
   ("523610101af5dc2481bdce53a050d680bbc516c64baf32463cf95ab3b18aa261",["out"]),
   ("5d7766754e92a0a96ca3b732ae0d9e3da892994961cee1500d7c689a0ddcb785",["out"]),
   ("61fd1308247835184ffe88140f9025117edb3210c47d617feafa33572ad8b8e3",["out"]),
   ("6ae6f3630665d92a495a4edb0f337fe1884fff9e6adcef65cf1c79131071d127",["out"]),
   ("7b8ef27665067602e4e27e801c6e8f385bd83b378037a60a4f5953a02b12c74f",["out"]),
   ("81c2221261670003975a89df35fba774c3871f4444c0d3a1eef6ef21e7aba678",["out"]),
   ("875b4153b80df041b31b6d0fb93b4bb8b62fbd3938320a8ce6ff263d01b3a536",["out"]),
   ("89e81aee370115bec522ad48de0f59030f227fe8a599bb409352a34e710669f8",["out"]),
   ("a127853978c101a2b52071108ed48834435c0bbaf1b707c13304ef9d8e70c3a6",["out"]),
   ("ab4bf18925deebcc80259b45cba39b348320a03f61d93e2246dcd6f5d28a1b68",["out"]),
   ("afe40de343b27326b5e6089c8adf8fdbdb105dcc35f671025c87de0bba965184",["out"]),
   ("bc726d150b4ba6aa8624eba59ad092d729705de4f0148391d33dac15a8aa5dbf",["out"]),
   ("bfb16f9021e341594cfce1c772ccd491599694460ac1df24a8bb77fadc2a4a04",["out"]),
   ("e226a8e968c6132524948d4fd0483a16603b57bddc92f97d6ce31580889754c2",["out"]),
   ("f662215314a37fcf8ae79e425bd197b3a3351bd8ff3d90506cc069c83c833b6d",["out"])],
  ["/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
   "x86_64-linux",
   "/gnu/store/d8gkn84yqacjr80pzicz1ka3y2s1f2x0-guile-2.2.2/bin/guile",
  ["--no-auto-compile",
   "-L",
   "/gnu/store/xhwmxry8kkmq7897558qmcmfsx8r1z45-module-import",
   "/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
  [("GUILE_LOAD_COMPILED_PATH","/gnu/store/r7sf4w2wwrbxbcf04pi9a5gkdhzaya2g-module-import-compiled"),
   ("out","")]
)

This is now what is actually hashed, just without any formatting. (Next) The key parts are the hashes of all the input derivations. (Next) The description of the build process. (Next) And finally, the environment variables. (Next) When this derivation is handed over to the build daemon, it will run the build process in an isolated environment. The build process will only be able to read from the areas of the store that are inputs to the derivation. It will also only be able to write to the specified output locations. Network access is disabled, to ensure that the process isn't able to access the network, avoiding the possibility that it depends on something via the network.


            $ guix build --derivations hello
/gnu/store/1drc59xkcvgdphzgylxm41ln9p5dwbgn-hello-2.10.drv


            Derive(
  [("out","/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10","","")],
  [("/gnu/store/0gabs9i1zawd406rkkr7l15ifg61s34r-glibc-2.25.drv",["out"]),
   ("/gnu/store/1lqw4mz8xzjhnb65kc1nvk8wg39spv5j-hello-2.10.tar.gz.drv",["out"]),
   ("/gnu/store/1vmhamqwgs3qa7rw28am5rm3b9fjs163-file-5.30.drv",["out"]),
   ("/gnu/store/23h9fzinl5j1s5x7r2i155f1m7ify9wl-ld-wrapper-0.drv",["out"]),
   ("/gnu/store/3li1y3cc8rkr4d0q9h8bkvl4h3macnf6-bash-minimal-4.4.12.drv",["out"]),
   ("/gnu/store/6y5h0pbqci67ql1ij5crkchjzmxkafbv-gawk-4.1.4.drv",["out"]),
   ("/gnu/store/8xmbpyfnh5cdrk9fmx8j67894bq9vl1r-module-import.drv",["out"]),
   ("/gnu/store/9sahk6fh2p5k631rxl6amx0cd4z8jn0s-diffutils-3.6.drv",["out"]),
   ("/gnu/store/cm2f8yxfpy353kxbq5gl7whzvmkl9niv-make-4.2.1.drv",["out"]),
   ("/gnu/store/fqx5lcb8lhdxkw1dwcgahnqaxgaycgb1-tar-1.29.drv",["out"]),
   ("/gnu/store/i5fzg4cq88yvl2i7bsnqprzgq494bpdm-patch-2.7.5.drv",["out"]),
   ("/gnu/store/iwzysdzl3yphqa0c0km8liiimcsrxmvd-glibc-utf8-locales-2.25.drv",["out"]),
   ("/gnu/store/jwsvpyyxkmyg0wk3cic3b9q9wgimphkz-findutils-4.6.0.drv",["out"]),
   ("/gnu/store/m5kd44n51ns8zlc8mvii497xc2siydpb-coreutils-8.27.drv",["out"]),
   ("/gnu/store/pjgbs80jhzpm7lfpsa5dp6jgxkcv6n56-bzip2-1.0.6.drv",["out"]),
   ("/gnu/store/qgcr4gp3qz098yh6zsnn97dg4h8d2nbn-sed-4.4.drv",["out"]),
   ("/gnu/store/r49cqbngzhn8q1qr6cjsm4vs85vwzl9i-xz-5.2.2.drv",["out"]),
   ("/gnu/store/rkjydj936a096s70bxq7sz77bbxzfqvd-gzip-1.8.drv",["out"]),
   ("/gnu/store/vk9xdybvknvnnaxavdk2q43yvdq5h47r-binutils-2.28.drv",["out"]),
   ("/gnu/store/wrlssahrl79njwzwv8clcq8vdh2syppx-module-import-compiled.drv",["out"]),
   ("/gnu/store/xz5ikvwa6pyz11h0a5hmzf9rxyi5xjzw-guile-2.2.2.drv",["out"]),
   ("/gnu/store/zb0wzrfgiydmr8gbxywyrmg6yp68w4fj-linux-libre-headers-4.4.47.drv",["out"]),
   ("/gnu/store/zxiy6cnd05p90hmyk1mvr30lm17ghwim-grep-3.0.drv",["out"]),
   ("/gnu/store/zxkwsk4g0m7j2p54l7xp2gblb6v4zddf-gcc-5.4.0.drv",["out"])],
  ["/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
   "x86_64-linux",
   "/gnu/store/d8gkn84yqacjr80pzicz1ka3y2s1f2x0-guile-2.2.2/bin/guile",
  ["--no-auto-compile",
   "-L",
   "/gnu/store/xhwmxry8kkmq7897558qmcmfsx8r1z45-module-import",
   "/gnu/store/hqlhinp4gsfym9l5bq63c7g8y1j14ynz-hello-2.10-guile-builder"],
  [("GUILE_LOAD_COMPILED_PATH","/gnu/store/r7sf4w2wwrbxbcf04pi9a5gkdhzaya2g-module-import-compiled"),
   ("out","/gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10")]
)

Fixed-output derivation

$ guix build -S -d hello
/gnu/store/1lqw4mz8xzjhnb65kc1nvk8wg39spv5j-hello-2.10.tar.gz.drv

Derive(
  [("out",
    "/gnu/store/hbdalsf5lpf01x4dcknwx6xbn6n5km6k-hello-2.10.tar.gz",
    "sha256",
    "31e066137a962676e89f69d1b65382de95a7ef7d914b8cb956f41ea72e0f516b")],
  [],
  ["/gnu/store/qivc6nybj6mxa95h7h10hg7qv81rdfcm-mirrors",
   "/gnu/store/wvbspgpk15aq6kcf2f67xjai1fbkbyqc-content-addressed-mirrors"],
  "x86_64-linux",
  "builtin:download",
  [],
  [("content-addressed-mirrors","/gnu/store/wvbspgpk15aq6kcf2f67xjai1fbkbyqc-content-addressed-mirrors"),
   ("impureEnvVars","http_proxy https_proxy LC_ALL LC_MESSAGES LANG COLUMNS"),
   ("mirrors","/gnu/store/qivc6nybj6mxa95h7h10hg7qv81rdfcm-mirrors"),
   ("out","/gnu/store/hbdalsf5lpf01x4dcknwx6xbn6n5km6k-hello-2.10.tar.gz"),
   ("preferLocalBuild","1"),
   ("url","\"mirror://gnu/hello/hello-2.10.tar.gz\"")]
)

Derivation graph for the hello package

Here is the bigger picture. This is the graph of derivations, both with fixed output and non-fixed output derivations. If you can make it out, the fixed output derivations are in black, and the other derivations are in purple. The fixed output derivations tend to sit around the edge of the graph, as they describe the building blocks used in the other derivations. Fixed output derivations are used to describe the source code of software, e.g. a source tarball or git repository checkout. There are also bootstrap binaries in the graph. You can't just go from source code, with no compiler, to compiling a compiler, so Guix includes some bootstrap binaries to get started with. Other fixed output derivations include patches that are applied to source code, the build scripts, and Guile modules that are used in the build scripts. This graph also includes the Guix bootstraping process, for getting from the bootstrap binaries, to GNU hello, and everything in between. Also, thinking back to what goes in to the hash for the outout of a derivation, that is the hashes of the input derivations, the build process and environment variables for non-fixed output derivations, and the output name, hash algorithm and value for fixed output derivations, we can now start to look at when changes happen in this graph, what will happen to the outputs for derivations. For exapmle, if you were to change the source code for the hello package, that would mean that the hash would be different, therefore the hash of the fixed output derivation would be different. As that hash is part of the hash of the hello derivation, its hash would change as well. Comparing this with a Debian package for example, which would always produce /usr/bin/hello, regardless of the source code, the way that the derivations output is computed means that having hello in the store twice just works. While I think it can be useful to understand these low level details, Guix provides software and tooling to make it easy to manage and manipulate derivations, using higher level concepts like packages, build systems and more.

The hello package

            (define-public hello
  (package
    (name "hello")
    (version "2.10")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/hello/hello-" version
                                  ".tar.gz"))
              (sha256
               (base32
                "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"))))
    (build-system gnu-build-system)
    (synopsis "Hello, GNU world: An example GNU package")
    (description
     "GNU Hello prints the message \"Hello, world!\" and then exits.  It
serves as an example of standard GNU coding practices.  As such, it supports
command-line arguments, multiple languages, and so on.")
    (home-page "https://www.gnu.org/software/hello/")
    (license gpl3+)))

What can you do with Guix?

Install a package in to your profile


            guix package -i hello

Upgrade the packages in your profile


            guix package -u

Roll back to the previous generation of your profile


            guix package --roll-back

guix package -i samtools bowtie

Modified, © Ricardo Wurmus

Obviously, knowing this isn't required to use the commands I just mentioned, but this is a technical talk, so lets go through the details. Normally, you'd have a .guix-profile symlink in your home directory. This symlink then points to a file in /var/guix representing the current version of the profile. This file is also a symlink, which links to a file in the same directory. The name of this file is a number, which is the generation of the profile. This numbered file, in this case 42, is yet another symlink. This symlink finally points to the profile within the store. Profiles in the store are a way of composing packages. A profile contains symlinks to other packages in the store, in a convenient directory structure, e.g. all of the files in the /bin directory within packages end up in the /bin directory of the profile.

guix package -r bowtie

Modified, © Ricardo Wurmus

guix package --roll-back

Modified, © Ricardo Wurmus

Wait a minute, what was installed?


            guix package -i hello

What did this actually install? While this may look ambiguous, just install hello, it actually ends up being rather specific. The instruction here to install hello will match a specific package. If there are multiple packages with the name hello, then the version can be used to disambiguate. By default, Guix will pick the highest version. The package describes everything about how to build that software, all the way down to the bootstrap binaries. (Next) When you install hello, you specify hello built through the process described in this diagram. Now I guess most users of guix will fetch a binary substitute for the hello package, and any dependencies they need, rather than going through the process of building it. All of this means that Guix gives you the means to get a high degree of reproducibility and determinism when using software. There is no guarantee that the output will be identical bit for bit, but that is something that the Guix project is working towards, along with other people and projects in the free software community. There is however a guarantee that the process will be identical. The hello package isn't a very good example of this, but imagine a more complicated scenario, some software with many more dependencies and complexity. There is a danger with some approaches that as you make changes, other changes occur because of a lack of reproducibility. With Debian for example, unless you are quite careful with the versioned dependency constraints and the available packages, there is a potential for new versions of software to creep in from repositories that you're using. With Guix, providing you are using the same package definitions, you'll get the same reproducible process when building your software.


guix environment hello


            guix environment --ad-hoc hello guile

/gnu/store/5w8jk6p57l5an1d39lngw560r2bw2dx1-profile/bin
├── guild -> /gnu/store/yih…6fk-guile-2.2.2/bin/guild
├── guile -> /gnu/store/yih…6fk-guile-2.2.2/bin/guile
├── guile-config -> /gnu/store/yih…6fk-guile-2.2.2/bin/guile-config
├── guile-snarf -> /gnu/store/yih…6fk-guile-2.2.2/bin/guile-snarf
├── guile-tools -> /gnu/store/yih…6fk-guile-2.2.2/bin/guile-tools
└── hello -> /gnu/store/wf6…2sx-hello-2.10/bin/hello


            guix environment --pure --ad-hoc hello


            guix environment --container --ad-hoc hello

$ echo /gnu/store/*
/gnu/store/…-ncurses-6.0      /gnu/store/…-profile
/gnu/store/…-manual-database  /gnu/store/…-gcc-5.4.0-lib
/gnu/store/…-info-dir         /gnu/store/…-bash-4.4.12
/gnu/store/…-readline-7.0     /gnu/store/…-glibc-2.25
/gnu/store/…-hello-2.10       /gnu/store/…-bash-static-4.4.12

You can do more for isolation through. The guix environment command has a neat --container argument. This means that the subshell you enter will be in a new mount, pid, ipc, uts, user and network namespace. The new mount namespace only gives the environment access to the store items that are needed, some default other directories, as well as the current working directory. Here, I'm using echo to show the files in the store. I can't use ls, but coreutils isn't in this environment. What is show here is the minimal set of packages required to run hello, and also the bash shell in which the echo command is running. Now, this is only possible because the information about the complete dependencies needed to run hello which are stored in the database accompanying the store.

Graph of the hello package references

$ ldd /gnu/store/wf65hjwqwpz4wllasn63zysi5irql2sx-hello-2.10/bin/hello

linux-vdso.so.1 (0x00007ffece166000)
libgcc_s.so.1 => /gnu/store/3x53yv4v144c9xp02rs64z7j597kkqax-gcc-5.4.0-lib/lib/libgcc_s.so.1 (0x00007fee83076000)
libc.so.6 => /gnu/store/n6nvxlk2j8ysffjh3jphn1k5silnakh6-glibc-2.25/lib/libc.so.6 (0x00007fee82cd7000)
/gnu/store/n6nvxlk2j8ysffjh3jphn1k5silnakh6-glibc-2.25/lib/ld-linux-x86-64.so.2 (0x00007fee8328d000)

Lets take a deeper look. When the hello store item references the gcc and glibc store items, it literally contains references to those directories in the binary. If you use the ldd command to show the shared libraries that are linked against, then you see the exact paths being specified. This is good for a number of reasons. From a reliability point of view, this helps, as hello is going to be consistent in the shared libraries that it loads. This particular way of using shared libraries, as well as other approaches to have store items reference each other is one of the tools packages in guix use to make the software less vulnerable to change and breakages. Another benefit of this is that you are still doing dynamic linking. I've heard of people not using dynamic linking, and statically linking executables to get some of the same benefits that Guix provides, but statically linked binaries can consume more disk and memory space, Guix I think gives you the best of both worlds, reliable dynamic linking.

Guix + Direnv


            use guix --ad-hoc gcc-toolchain python python-lxml


            $ cd /tmp/foo
direnv: loading .envrc
direnv: using guix --ad-hoc gcc-toolchain python python-lxml
direnv: export +PAGER +PYTHONPATH ~CPLUS_INCLUDE_PATH
               ~C_INCLUDE_PATH ~LIBRARY_PATH ~PATH

Managing systems and services with Guix

Systems

(use-modules (gnu))
(use-service-modules networking ssh)
(use-package-modules screen ssh)

(operating-system
  (host-name "komputilo")
  (timezone "Europe/Berlin")
  (locale "en_US.utf8")

  (bootloader (bootloader-configuration
                (bootloader grub-bootloader)
                (target "/dev/sdX")))
  (file-systems (cons (file-system
                        (device "my-root")
                        (title 'label)
                        (mount-point "/")
                        (type "ext4"))
                      %base-file-systems))

  (users (cons (user-account
                (name "alice")
                (comment "Bob's sister")
                (group "users")
                (supplementary-groups '("wheel"
                                        "audio" "video"))
                (home-directory "/home/alice"))
               %base-user-accounts))

  (packages (cons* screen openssh %base-packages))

  (services (cons* (dhcp-client-service)
                   (service openssh-service-type
                            (openssh-configuration
                              (port-number 2222)))
              %base-services)))

Currently when using GuixSD, you'll probably be using a configuration file for the system. Here is a modified version of the bare bones example included within Guix. This specification allows you to declare a whole load of different things about your system, the filesystems, users, packages, services and more. When using GuixSD, the filesystem is a bit different from other distributions. You don't by default have a /usr directory. As Guix manages packages in per user profiles, with the addition of a system profile, managing a stateful /usr directory would possibly impact some of the advantages that Guix brings. That doesn't mean you can't have stateful files in /usr though, on this laptop I have /usr/bin/env and /usr/share/zoneinfo, as that helps with some software that I use. Another point to mention about GuixSD is how changes to this configuration work. Changes work similar to the changes to package profiles, there are generations of the system in /var/guix/profiles, and to apply a change in the configuration to a system, you reconfigure the system to use that configuration. This process generates the new system state, and then switches to it as atomically as possible. This, along with the ability to boot in to previous generations of the system make GuixSD very reliable. Generations of the system don't only include Linux, but other components of the system like services and file system configuration. I really like this. For example, I reconfigured this laptop yesterday, save in the knowledge that if anything went wrong, I could just boot in to the previous generation of my system. Compared to other ways I've managed systems, I think using Guix has a lot of advantages. The broad way in which Guix manages the system configuration, and does so as a proper feature set it apart from other systems I've used, like Ansible and Puppet, where you attempt to converge some system to the desired state, and usually specify more about what you want, than what you don't, which can leave room for systems to become inconsistent in bad ways. I'm also enjoying not having to convince apt to untangle Debian systems that I've broken when trying to upgrade.

Services

...

  (services (cons* (dhcp-client-service)
                   (service openssh-service-type
                            (openssh-configuration
                              (port-number 2222)))
                   %base-services)))

One important part of GuixSD is the services. Guix packages are usable on other systems, however services are specific to GuixSD. They are similar though, in that they are both described through values in Guile. I won't go in to writing service definitions here, though it is something that I quite enjoy doing. There are quite a few examples in Guix at the moment, so you might be able to get a feel for them by looking at the documentation and the source code. Guix services can cooperate together by a process called service extension. For example, services that describe a daemon extend the root shepherd service, passing across the details of the service they want to provide.

Extension graph

Shepherd graph

Extending Guix

Writing a package definition

Importers available for: gnu, nix, pypi, cpan, hackage, stackage, elpa, gem, cran, crate, texlive and json.

Hello package definition

            (define-public hello
  (package
    (name "hello")
    (version "2.10")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/hello/hello-" version
                                  ".tar.gz"))
              (sha256
               (base32
                "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"))))
    (build-system gnu-build-system)
    (synopsis "Hello, GNU world: An example GNU package")
    (description
     "GNU Hello prints the message \"Hello, world!\" and then exits.  It
serves as an example of standard GNU coding practices.  As such, it supports
command-line arguments, multiple languages, and so on.")
    (home-page "https://www.gnu.org/software/hello/")
    (license gpl3+)))

Inheritance

(define-public ruby-2.3
  (package
    (inherit ruby)
    (version "2.3.5")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "http://cache.ruby-lang.org/pub/ruby/"
                           (version-major+minor version)
                           "/ruby-" version ".tar.xz"))
       (sha256
        (base32
         "1npzcnq5kh0f9y88w5gj4v6ln8csr91361k3r43dmhlhn6mpsfkx"))
       (modules '((guix build utils)))
       (snippet `(begin
                   ;; Remove bundled libffi
                   (delete-file-recursively "ext/fiddle/libffi-3.2.1")
                   #t))))))

G-expressions, a way of staging code

(define build-exp
  #~(begin
      (mkdir #$output)
      (chdir #$output)
      (symlink (string-append #$coreutils "/bin/ls")
               "list-files")))

What is Guix?

Standalone package definitions
+ bootstrap binaries

Package management tool + library

GNU+Linux distribution, with declarative
configuration for the system and services

Build packages from source, offload build tasks to other machines, copy store items to other machines, graph packages and systems, inspect the size of store items, publish substitutes, run the garbage collector, generate package definitions from various sources, update package definitions for new releases, build raw or ISO disk images...

Given all of this, the question "what is Guix?" isn't very easy to give a single answer to. (Next fragment) One aspect of Guix is the standalone package definitions, and the bootstrap binaries. Together providing a stable, controllable and inspectable set of software which you can use directly, and also use as a stable foundation to build upon. (Next fragment) Along with this, Guix has tooling to make use of the package definitions, providing a number of different ways in which to use them. From the guix package command, to manage persistent profiles, to the guix environment command to create more temporary profiles and development environments, to the guix pack command, which allows you to take packages and pack them up in different ways, currently a tarball and Docker image also known as the Open Container Initiative image format. Even more functionality and flexibility is available if you need it, by directly using Guix as a library. (Next fragment) On top of all of this, Guix provides and brings together the software and tooling you need to setup a GNU+Linux distribution, a.k.a GuixSD, the Guix system distribution. The state of the system can be specified in a declarative way, from the user accounts, to the file systems, to the configuration for many services like PostgreSQL, OpenSSH, MongoDB, nginx, Dovecot and many more. Using the same approaches as for packages and profiles, this offers roll backs for the system profile, not only switching back to a previous version of Linux if applicable, but other parts of the system as well. To complement this, Guix includes the tooling for systems to generate disk images, system containers and virtual machines, all from a operating system definition. (Next fragment) And then come all the smaller features, that I think still make a big difference. Building packages from source is seemless, just change the package definition, and then use it. If you need to change a dependency of the package you care about, or a dependency of a dependency of a package you care about, then its no different. Build tasks can be offloaded to other machines. You can generate graphs for packages, showing the inputs, and their inputs, and so on. The guix size command will show you the references of a store item, along with their size. The guix publish command and service can be used to publish binary substitutes, for use on other machines. The guix gc command invokes the garbage collector allows you to remove unused items from the store, freeing up disk space. The guix import command can generate package definitions from various sources like the Python package index, Rubygems.org, CPAN, Hackage, Stackage, Elpa and more. The guix refresh command can for some packages update the package definitions, by checking for new releases. And... there is probably even more things that I've missed, and I haven't even covered any of the tooling that people have built that uses or enhances Guix.

Use Guix!

Install Guix within an existing system.

Install GuixSD, a distribution of GNU+Linux.

If you are going to directly benefit from all of this, then there are a few different ways of using Guix. You can use it within a existing system. The Linux and Hurd kernels are supported, and Guix has been ported to the x86 64, i686 and armhf architectures. Due to the way Guix works, it's very isolated from the system its installed on. By default, just requiring two directories, /gnu and /var/guix and the build daemon to be running. With Guix installed within an existing system, you can create system containers, virtual machines, but to take full advantage of features such as the declarative system configuration, you'll need to install GuixSD.

Talk to others on

#guix on freenode

For the manual, mailing lists, papers, blog posts and talks, go to https://gnu.org/s/guix/help

GNU Guix

Package manager, system distribution and more…

Guix...

Why another package management tool?

UserControl / Freedom

How does Guix work?

1993

2004

2012

2017

The store

Fixed-output derivation

The hello package

What can you do with Guix?

Install a package in to your profile

Upgrade the packages in your profile

Roll back to the previous generation of your profile

Wait a minute, what was installed?

Guix + Direnv

Managing systems and services with Guix

Systems

Services

Extending Guix

Writing a package definition

Hello package definition

Inheritance

G-expressions, a way of staging code

What is Guix?

Use Guix!

Talk to others on

#guix on freenode

Package manager,
system distribution
and more…

User
Control / Freedom