emacswiki snippets: cleanup

[AndersonTorres]

Description of changes

#278925 (comment)

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[jian-lin]

What is the motivation/benefit of adding emacswiki?

One disadvantage is that one package, e.g., yes-no, may remains the same even if its version changes.

[AndersonTorres]

Technically the source is the Emacswiki git repo.
Also, the Emacswiki can be kept frozen - their snippets are not being updated since decades.

---

To be honest I believe those packages should not be distributed by Nixpkgs.

They were removed from MELPA a long time ago because they were reputed insecure by design (anyone can edit a wiki). Some were migrated, others were effectively abandoned.

Essentially they are candidates for removal, per NixOS/rfcs#180

Many links documenting MELPA deleting Emacswiki

melpa/melpa#5034
melpa/melpa#5008

https://www.reddit.com/r/emacs/comments/7vocqa/comment/dtuhzmt/
https://www.reddit.com/r/emacs/comments/f4may5/why_melpa_has_decided_to_no_longer_accept_lisp/
https://www.reddit.com/r/emacs/comments/7suq6d/melpa_has_stopped_distributing_insecure_emacswiki/
https://www.reddit.com/r/emacs/comments/7vocqa/update_on_melpa_removing_emacswiki_packages_they/
https://www.reddit.com/r/emacs/comments/72b2ms/discussion_about_removing_all_emacswiki_packages/

[AndersonTorres]

Well, a somewhat hacky approach would be create GitHub repos for these snippets, at least the ones we want to keep on Nixpkgs. They can be easily extracted from EmacsWiki github.

[jian-lin]

Technically the source is the Emacswiki git repo.

I still do not see the benefit of inherit (emacswiki) version src; over

  src = fetchurl {
    url = "https://raw.githubusercontent.com/emacsmirror/emacswiki.org/185fdc34fb1e02b43759ad933d3ee5646b0e78f8/control-lock.el";
    hash = "sha256-JCrmS3FSGDHSR+eAR0X/uO0nAgd3TUmFxwEVH5+KV+4=";
  };

the Emacswiki can be kept frozen - their snippets are not being updated since decades.

Not sure what you mean, but emacswiki.src is updated frequently. See https://github.com/emacsmirror/emacswiki.org/commits/master/ .

---

To be honest I believe those packages should not be distributed by Nixpkgs.
They were removed from MELPA a long time ago because they were reputed insecure by design (anyone can edit a wiki).

IIUC, MELPA does not have a maintainer role for each of its packages. It just build and publish a package when there is a new version (snapshot or release). In this model, the code on wiki is indeed insecure.

Nixpkgs is different, we have meta.maintainers for each package. In this model, the code on wiki is secure (or less insecure).

Packages with an empty meta.maintainers can be removed or mark as insecure (with meta.knownVulnerabilities). They can be added back if someone becomes its maintainer.

Well, a somewhat hacky approach would be create GitHub repos for these snippets, at least the ones we want to keep on Nixpkgs. They can be easily extracted from EmacsWiki github.

There is no benefit of just fetching wiki packages from another source. What matters is maintenance which is the job of meta.maintainers.

The emacswiki = callPackage ./manual-packages/emacswiki { }; and inherit (emacswiki) version src; pattern actually makes wiki packages in Nixpkgs less secure because their maintainer cannot control src.

[AndersonTorres]

Not sure what you mean, but emacswiki.src is updated frequently. See https://github.com/emacsmirror/emacswiki.org/commits/master/ .

The EmacsWiki is modified potentially daily. However, most of Elisp codes aren't.
Indeed the perl-completion you cited was not touched since its inception nine years ago.

In this sense, we could just update this blob once a year.

The emacswiki = callPackage ./manual-packages/emacswiki { }; and inherit (emacswiki) version src; pattern actually makes wiki packages in Nixpkgs less secure because their maintainer cannot control src.

It is not hard to write something like grabEmacsWiki { rev = ""; hash = ""; }.

---

Nonetheless you are correct. Let's undo this.

[jian-lin]

Technically the source is the Emacswiki git repo.

I still do not see the benefit of inherit (emacswiki) version src; over

  src = fetchurl {
    url = "https://raw.githubusercontent.com/emacsmirror/emacswiki.org/185fdc34fb1e02b43759ad933d3ee5646b0e78f8/control-lock.el";
    hash = "sha256-JCrmS3FSGDHSR+eAR0X/uO0nAgd3TUmFxwEVH5+KV+4=";
  };

the Emacswiki can be kept frozen - their snippets are not being updated since decades.

Not sure what you mean, but emacswiki.src is updated frequently. See https://github.com/emacsmirror/emacswiki.org/commits/master/ .

---

To be honest I believe those packages should not be distributed by Nixpkgs.
They were removed from MELPA a long time ago because they were reputed insecure by design (anyone can edit a wiki).

IIUC, MELPA does not have a maintainer role for each of its packages. It just build and publish a package when there is a new version (snapshot or release). In this model, the code on wiki is indeed insecure.

Nixpkgs is different, we have meta.maintainers for each package. In this model, the code on wiki is secure (or less insecure).

Packages with an empty meta.maintainers can be removed or mark as insecure (with meta.knownVulnerabilities). They can be added back if someone becomes its maintainer.

Well, a somewhat hacky approach would be create GitHub repos for these snippets, at least the ones we want to keep on Nixpkgs. They can be easily extracted from EmacsWiki github.

There is no benefit of just fetching wiki packages from another source. What matters is maintenance which is the job of meta.maintainers.

The emacswiki = callPackage ./manual-packages/emacswiki { }; and inherit (emacswiki) version src; pattern actually makes wiki packages in Nixpkgs less secure because their maintainer cannot control src.

[jian-lin]

LGTM