aboutsummaryrefslogtreecommitdiff
path: root/ROADMAP
blob: 2475cb637ceb6eb43f54d080c56e5793041b76e5 (about) (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
-*- mode: org; coding: utf-8; -*-

#+TITLE: Tentative GNU Guix Road Map

Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>

  Copying and distribution of this file, with or without modification,
  are permitted in any medium without royalty provided the copyright
  notice and this notice are preserved.

The goals of the GNU Guix project are two-fold:

  - to build a purely functional package manager, based on Nix and
    Guile;

  - to use it to build a practical 100% free software distribution of
    GNU/Linux and possibly other GNU variants, with a focus on the
    promotion and tight integration of GNU components–the GNU system.

Since its inception, the project has gone a long way towards that goal.  Below
is a list of items we want for version "1.0" of the Guix System Distribution.
There will be a few 0.x releases by then to give the new features more
exposure and testing.

You're welcome to discuss this road map on guix-devel@gnu.org or #guix on
Freenode!

* Features scheduled for 1.0

  - larger & more robust build farm
    + we need a powerful, dedicated front-end
    + armhf-linux build machine
    + leave Hydra in favor of 'guix publish' + custom code?
  - more OS features
    + LVM support
    + encrypted root
    + configurable name service switch
    + whole-system unit tests, using VMs
  - more service definitions
    + mcron, postfix(?), wicd(?), etc.
  - better 'guix system'
    + 'reconfigure' should be able to restart non-essential services
    + support for '--list-generations' and '--delete-generations'
  - better 'guix pull'
    + using Git to fetch the source instead of re-downloading everything
    + build more quickly
    + install new .mo files and new manual
    + authentication of the Guix source: use signed commits?
  - simplified, purely declarative service list in 'operating-system'
    + it should be possible to inspect the service instance declarations and
      settings
  - GUIs
    + integrate guix-web?
    + guile-ncurses installer?
  - 'guix publish'?

* Features for later

  - complete GNU/Hurd port
  - use content-based addressing when downloading substitutes to reduce
    bandwidth requirements
    + design nar v2 format where file contents are replaced by their hashes
    + leverage /gnu/store/.links
  - binary origin tracking
    + keep signatures in sqlite.db
    + preserve signatures upon import/export
  - peer-to-peer distribution of updates (GNUnet?)
  - more deterministic builds
    + identify & fix sources of non-determinism in builds
    + strengthen guix-daemon containers to further increase reproducibility
    + trusting-trust: bootstrap with different tool chains
    + fixed-point: re-bootstrap until fixed point is reached
    + distributed validation: compare contents of store items with others
      * resist a hydra.gnu.org compromise
  - reproducible containers: mix of 'guix environment' and 'guix system vm'
  - execute code with least privilege
    + build containers like guix-daemon does
    + provide a Plash-like interface in Bash
  - daemon rewritten in Guile
  - more shepherd integration
    + monitor network interfaces and start/stop events based on that
    + include a DHCP client written in Scheme
0 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2012, 2013 Andreas Enge <andreas@enge.fr>
;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
;;; Copyright © 2016, 2022 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2012, 2013 Nikita Karetnikov <nikita@karetnikov.org>
;;; Copyright © 2012, 2017 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2017, 2019 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
;;; Copyright © 2020, 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu packages kerberos)
  #:use-module (gnu packages)
  #:use-module (gnu packages autotools)
  #:use-module (gnu packages bash)
  #:use-module (gnu packages bison)
  #:use-module (gnu packages dbm)
  #:use-module (gnu packages perl)
  #:use-module (gnu packages gettext)
  #:use-module (gnu packages gnupg)
  #:use-module (gnu packages libidn)
  #:use-module (gnu packages hurd)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages readline)
  #:use-module (gnu packages sqlite)
  #:use-module (gnu packages tcl)
  #:use-module (gnu packages texinfo)
  #:use-module (gnu packages tls)
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (guix packages)
  #:use-module (guix download)
  #:use-module (guix gexp)
  #:use-module (guix utils)
  #:use-module (guix build-system gnu))

(define-public mit-krb5
  (package
    (name "mit-krb5")
    (version "1.19.2")
    (source (origin
              (method url-fetch)
              (uri (list
                    (string-append "https://web.mit.edu/kerberos/dist/krb5/"
                                   (version-major+minor version)
                                   "/krb5-" version ".tar.gz")
                    (string-append "https://kerberos.org/dist/krb5/"
                                   (version-major+minor version)
                                   "/krb5-" version ".tar.gz")))
              (patches (search-patches "mit-krb5-hurd.patch"))
              (sha256
               (base32
                "0snz1jm2w4dkk65zcz953jmmv9mqa30fanch2bk8r3rs9vp3yi8h"))))
    (build-system gnu-build-system)
    (native-inputs
     (list bison perl tcl))                   ;required for some tests
    (inputs
     (list openssl))
    (arguments
     `(;; XXX: On 32-bit systems, 'kdb5_util' hangs on an fcntl/F_SETLKW call
       ;; while running the tests in 'src/tests'. Also disable tests when
       ;; cross-compiling.
       #:tests? ,(and (not (%current-target-system))
                      (string=? (%current-system) "x86_64-linux"))

       ,@(if (%current-target-system)
             '(#:configure-flags
               (list "--localstatedir=/var"
                     "krb5_cv_attr_constructor_destructor=yes"
                     "ac_cv_func_regcomp=yes"
                     "ac_cv_printf_positional=yes"
                     "ac_cv_file__etc_environment=yes"
                     "ac_cv_file__etc_TIMEZONE=no")
               #:make-flags
               (list "CFLAGS+=-DDESTRUCTOR_ATTR_WORKS=1"))
             '(#:configure-flags
               (list "--localstatedir=/var")))
       #:phases
       (modify-phases %standard-phases
         (add-after 'unpack 'enter-source-directory
           (lambda _
             (chdir "src")))
         (add-before 'check 'pre-check
           (lambda* (#:key inputs native-inputs #:allow-other-keys)
             (let ((perl (assoc-ref (or native-inputs inputs) "perl")))
               (substitute* "plugins/kdb/db2/libdb2/test/run.test"
                 (("/bin/cat") (string-append perl "/bin/perl"))
                 (("D/bin/sh") (string-append "D" (which "sh")))
                 (("bindir=/bin/.") (string-append "bindir=" perl "/bin")))))))))
    (synopsis "MIT Kerberos 5")
    (description
     "Massachusetts Institute of Technology implementation of Kerberos.
Kerberos is a network authentication protocol designed to provide strong
authentication for client/server applications by using secret-key
cryptography.")
    (license (license:non-copyleft "file://NOTICE"
                                   "See NOTICE in the distribution."))
    (home-page "https://web.mit.edu/kerberos/")
    (properties '((cpe-name . "kerberos")))))

(define-public shishi
  (package
    (name "shishi")
    (version "1.0.3")
    (source
     (origin
      (method url-fetch)
      (uri (string-append "mirror://gnu/shishi/shishi-"
                          version ".tar.gz"))
      (sha256
       (base32
        "14kyj7rdki2g1sj5k42y9v5ya9jar81yw483ivwa80fx2byqyycm"))))
    (build-system gnu-build-system)
    (arguments
     (list
       #:configure-flags
       #~(list "--disable-static"
               "--with-key-dir=/etc/shishi"
               "--with-db-dir=/var/shishi")
       #:phases
       #~(modify-phases %standard-phases
           (add-after 'configure 'disable-automatic-key-generation
             (lambda _
               (substitute* "Makefile"
                (("^install-data-hook:")
                 "install-data-hook:\nx:\n")))))))
    (native-inputs (list pkg-config))
    (inputs
     (list gnutls
           libidn
           linux-pam
           zlib
           libgcrypt
           libtasn1))
    (home-page "https://www.gnu.org/software/shishi/")
    (synopsis "Implementation of the Kerberos 5 network security system")
    (description
     "GNU Shishi is a free implementation of the Kerberos 5 network security
system.  It is used to allow non-secure network nodes to communicate in a
secure manner through client-server mutual authentication via tickets.

After installation, the system administrator should generate keys using
@code{shisa -a /etc/shishi/shishi.keys}.")
    (license license:gpl3+)))

(define-public heimdal
  (package
    (name "heimdal")
    (version "7.7.0")
    (source (origin
              (method url-fetch)
              (uri (string-append
                    "https://github.com/heimdal/heimdal/releases/download/"
                    "heimdal-" version "/" "heimdal-" version ".tar.gz"))
              (sha256
               (base32
                "06vx3cb01s4lv3lpv0qzbbj97cln1np1wjphkkmmbk1lsqa36bgh"))
              (modules '((guix build utils)))
              (snippet
               '(begin
                  (substitute* "configure"
                    (("User=.*$") "User=Guix\n")
                    (("Host=.*$") "Host=GNU")
                    (("Date=.*$") "Date=2019\n"))))))
    (build-system gnu-build-system)
    (arguments
     `(#:configure-flags
       ,#~(list
           ;; Avoid 7 MiB of .a files.
           "--disable-static"

           ;; Do not build libedit.
           (string-append
            "--with-readline-lib="
            (assoc-ref %build-inputs "readline") "/lib")
           (string-append
            "--with-readline-include="
            (assoc-ref %build-inputs "readline") "/include")

           ;; Do not build sqlite.
           (string-append
            "--with-sqlite3="
            (assoc-ref %build-inputs "sqlite"))

           #$@(if (%current-target-system)
                  ;; The configure script is too pessimistic.
                  ;; Setting this also resolves a linking error.
                  #~("ac_cv_func_getpwnam_r_posix=yes"
                     ;; Allow 'slc' and 'asn1_compile' to be found.
                     (string-append "--with-cross-tools="
                                    #+(file-append this-package
                                                   "/libexec/heimdal")))
                  #~()))
       #:phases (modify-phases %standard-phases
                  (add-before 'configure 'pre-configure
                    (lambda* (#:key inputs #:allow-other-keys)
                      (substitute* "configure"
                        ;; The e2fsprogs input is included for libcom_err,
                        ;; let's use it even if cross-compiling.
                        (("test \"\\$\\{krb_cv_com_err\\}\" = \"yes\"")
                         ":")
                        ;; Our 'compile_et' is not in --with-cross-tools,
                        ;; which confuses heimdal.
                        (("ac_cv_prog_COMPILE_ET=\\$\\{with_cross_tools\\}compile_et")
                         "ac_cv_PROG_COMPILE_ET=compile_et"))
                      (substitute* '("appl/afsutil/pagsh.c" "appl/su/su.c")
                        (("/bin/sh")
                         (search-input-file inputs "bin/sh"))
                        ;; Use the cross-compiled bash instead of the
                        ;; native bash (XXX shouldn't _PATH_BSHELL point
                        ;; to a cross-compiled bash?).
                        (("_PATH_BSHELL")
                         (string-append
                          "\"" (search-input-file inputs "bin/sh") "\"")))
                      (substitute* '("tools/Makefile.in")
                        (("/bin/sh") (which "sh")))))
                  (add-before 'check 'pre-check
                    (lambda _
                      ;; For 'getxxyyy-test'.
                      (setenv "USER" (passwd:name (getpwuid (getuid))))

                      ;; Skip 'db' and 'kdc' tests for now.
                      ;; FIXME: figure out why 'kdc' tests fail.
                      (with-output-to-file "tests/db/have-db.in"
                        (lambda ()
                          (format #t "#!~a~%exit 1~%" (which "sh")))))))
       ;; Tests fail when run in parallel.
       #:parallel-tests? #f))
    (native-inputs (list e2fsprogs ;for 'compile_et'
                         texinfo
                         unzip ;for tests
                         perl))
    (inputs (list readline
                  bash-minimal
                  bdb
                  e2fsprogs ;for libcom_err
                  mit-krb5
                  sqlite))
    (home-page "http://www.h5l.org/")
    (synopsis "Kerberos 5 network authentication")
    (description
     "Heimdal is an implementation of Kerberos 5 network authentication
service.")
    (license license:bsd-3)))