Tracking source code: whatsrc.org

[Ludovic Courtès]

Hi!

kpcyrd <kpcyrd at archlinux.org> skribis:

> I'm indeed very interested, I looked at it briefly and have two questions:
>
> 1) In the `sources` list, how do I figure out which package a source
> object belongs to?

Oh, I had overlooked that; short answer is: you can’t tell which package
it corresponds to.

But with <https://guix.gnu.org/packages.json>, it should be possible
(that’s the file used by repology.org).

> 2) For `type: "git"`, how is `integrity` calculated?
>
> It's referencing `https://github.com/htop-dev/htop#tag=3.2.2` with
> `sha256-OrlNE1A71q4XAauYNfumV1Ev1wBpFIBxPiw7aF++yjM=` and I couldn't
> figure out how this is calculated.

There are two cases.  When it has "outputHashMode": "flat", it’s a hash
of the source file (tarball).

When it has "outputHashMode": "recursive", it’s indeed a hash of the
nar-encoded directory, typically a checkout (nar is the “Nix archive” or
“normalized archive” format, as I like to call it.)

You would need a serializer for the nar format in Rust if you wanted to
compute it.  I suspect fellow hackers who’ve been working on Tvix
(roughly a Rust implementation of the Nix build daemon) may have that
already:

  https://cs.tvl.fyi/depot/-/tree/tvix

[...]

>>> The site operates fairly co2 efficient (due to my Rust proficiency), I
>>> showed a friend what kind of specs I run this on and they were
>>> ✨stunned✨.
>> It’s behind CloudFlare though.  :-)
>
> Fair, I'm using a caching CDN in case an artifact that I indexed gets
> hackernews'd. :)

Fair enough.  :-)

> The web code is fairly boring, but running your own instance including
> the worker to index all mentioned distros can be done on a <5€/mo VPS:
>
> - 1 core
> - 2GB ram
> - 6GB swap
> - 10GB temporary disk to deal with git
> - disk for the database (currently 12GB big, but you should plan for
>   more obviously)

[...]

> And about 40MB in size.

Quite an achievement indeed!

Thanks,
Ludo’.