[Guix packaging] Zomia #599

New issue

Open

opened 2026-08-24 17:35:38 +00:00 by htayj · 1 comment

htayj commented

2026-08-24 17:35:38 +00:00

(Migrated from github.com)

Candidate

Project: Zomia
Candidate upstream/homepage: https://github.com/globalcitizen/zomia
Discovery evidence: IRLDb
Reported license: GPL3
License status: reported free license; verify exact terms and asset coverage against the pinned upstream source
Catalog note: IRLDb status: beta.

Scope

Package the independently playable roguelike from source. The canonical repository, latest stable release, source hash, complete dependency closure, and relationship to parent games or sibling forks must be established before implementation. Do not substitute an opaque prebuilt binary.

Research checklist

Identify the canonical maintained source repository and immutable release/commit.
Verify the exact FOSS license for code and every installed font, tile, sound, map, documentation, and bundled dependency.
Check GNU Guix and the channel audit set for an equivalent same-upstream package.
Determine the offline build system and source closure, including submodules or language registries.
Identify updater, telemetry, runtime download, mutable-state, and network behavior that needs Guix integration.

Acceptance checks

guix lint -L . <package> has no package-specific findings.
guix build -L . --no-grafts <package> succeeds without network access or opaque binaries.
Upstream tests run where available, and guix build -L . --no-grafts --check <package> verifies reproducibility.
A fresh HOME/XDG smoke test starts a real local game, exercises meaningful gameplay or save/load behavior, and proves no store writes.
Installed license and third-party notices cover the shipped closure and assets.

Imported from GitHub issue/PR. Originally posted by htayj on 2026-08-24T17:35:38Z.

## Candidate - Project: Zomia - Candidate upstream/homepage: https://github.com/globalcitizen/zomia - Discovery evidence: [IRLDb](https://forums.roguetemple.com/irldb/index.php?i=47e013c) - Reported license: GPL3 - License status: reported free license; verify exact terms and asset coverage against the pinned upstream source - Catalog note: IRLDb status: beta. ## Scope Package the independently playable roguelike from source. The canonical repository, latest stable release, source hash, complete dependency closure, and relationship to parent games or sibling forks must be established before implementation. Do not substitute an opaque prebuilt binary. ## Research checklist - Identify the canonical maintained source repository and immutable release/commit. - Verify the exact FOSS license for code and every installed font, tile, sound, map, documentation, and bundled dependency. - Check GNU Guix and the channel audit set for an equivalent same-upstream package. - Determine the offline build system and source closure, including submodules or language registries. - Identify updater, telemetry, runtime download, mutable-state, and network behavior that needs Guix integration. ## Acceptance checks - `guix lint -L . <package>` has no package-specific findings. - `guix build -L . --no-grafts <package>` succeeds without network access or opaque binaries. - Upstream tests run where available, and `guix build -L . --no-grafts --check <package>` verifies reproducibility. - A fresh HOME/XDG smoke test starts a real local game, exercises meaningful gameplay or save/load behavior, and proves no store writes. - Installed license and third-party notices cover the shipped closure and assets. --- Imported from [GitHub issue/PR](https://github.com/htayj/guix-channel/issues/599). Originally posted by [htayj](https://github.com/htayj) on 2026-08-24T17:35:38Z.

tay commented

2026-09-21 03:55:53 +00:00

Owner

Goocastle recorded disposition: blocked.

Zomia cannot be safely packaged from upstream v0.0.4 at commit 5547f7001787e877b1d7275fe0ef46291274cd53 (https://github.com/globalcitizen/zomia), the newest annotated release-tagged head available on 2026-09-21. No equivalent same-upstream package exists in this channel; rg -l '(?i)zomia' found only an incidental URL in guix/tay/packages/astx-npm-sources.scm. The parent repository declares GPL-3.0-only at this revision, and required submodule astray 268cb591fa5254c6b1da60f36f761f6d2eebe84b carries a permissive notice plus rotLove 68365b5b45e7a8f4169f48f0cc8d4c49e24bb306 and svglover d146bf84be84fb6cca1a1550a287f7dd9e4344b7 carry GPL-3.0-only; these origins are individually redistributable. Blocking defects remain: (1) the source tree records seven Gitlinks but .gitmodules declares only six; libs/tween gitlink 9cdcd39339ec9e8b9c1a08e65aa0a8f2aab62172 has no declared URL, is absent from the GitHub APIs for rxi/tween and vrld/tween, and cannot be resolved to an immutable authoritative origin; (2) required pinned origins slam c19dccec4828218e4a8746acfaf5b5ecf44a40ee, shack 01504489f1471619160c4ed31d35edb46476ff31, flux bb330231b87eabf84fbd68322f13a6320db30a41, and the unresolved tween Gitlink have neither LICENSE/COPYING files nor license-grant statements in their exact-revision READMEs. Their authorship alone provides no clear redistribution grant; (3) .gitmodules points svglover to the credential-bearing SSH URL git@github.com:globalcitizen/svglover.git, so an anonymous Guix git origin would require an equivalently authoritative HTTPS mapping; (4) the project is a LÖVE 0.10.1 game whose upstream README reports optional network music/sound download scripts, while the pinned tree contains three TTF fonts and 842 bundled MP3 sound effects. Its credits.txt attributes bundled music and sounds under CC BY 3.0, CC BY-SA 4.0, CC0 1.0, and public-domain grants, but the inspected head does not provide a machine-readable per-file license manifest. Consequently, exact coverage for every bundled font, tile, sound, and map cannot be established and default-free runtime behavior is not demonstrated. Unattended delivery is unsafe. This becomes unblocked only when a fixed upstream source provides a complete immutable origin for tween, explicit redistribution-compatible license grants for slam, shack, flux, tween, and every installed font and sound asset (including required attribution and share-alike obligations), HTTPS anonymous origins for all independently fetched sources, and a documented deterministic no-network runtime/smoke contract.

Goocastle recorded disposition: blocked. Zomia cannot be safely packaged from upstream v0.0.4 at commit 5547f7001787e877b1d7275fe0ef46291274cd53 (https://github.com/globalcitizen/zomia), the newest annotated release-tagged head available on 2026-09-21. No equivalent same-upstream package exists in this channel; `rg -l '(?i)zomia'` found only an incidental URL in guix/tay/packages/astx-npm-sources.scm. The parent repository declares GPL-3.0-only at this revision, and required submodule astray 268cb591fa5254c6b1da60f36f761f6d2eebe84b carries a permissive notice plus rotLove 68365b5b45e7a8f4169f48f0cc8d4c49e24bb306 and svglover d146bf84be84fb6cca1a1550a287f7dd9e4344b7 carry GPL-3.0-only; these origins are individually redistributable. Blocking defects remain: (1) the source tree records seven Gitlinks but .gitmodules declares only six; libs/tween gitlink 9cdcd39339ec9e8b9c1a08e65aa0a8f2aab62172 has no declared URL, is absent from the GitHub APIs for rxi/tween and vrld/tween, and cannot be resolved to an immutable authoritative origin; (2) required pinned origins slam c19dccec4828218e4a8746acfaf5b5ecf44a40ee, shack 01504489f1471619160c4ed31d35edb46476ff31, flux bb330231b87eabf84fbd68322f13a6320db30a41, and the unresolved tween Gitlink have neither LICENSE/COPYING files nor license-grant statements in their exact-revision READMEs. Their authorship alone provides no clear redistribution grant; (3) .gitmodules points svglover to the credential-bearing SSH URL git@github.com:globalcitizen/svglover.git, so an anonymous Guix git origin would require an equivalently authoritative HTTPS mapping; (4) the project is a LÖVE 0.10.1 game whose upstream README reports optional network music/sound download scripts, while the pinned tree contains three TTF fonts and 842 bundled MP3 sound effects. Its credits.txt attributes bundled music and sounds under CC BY 3.0, CC BY-SA 4.0, CC0 1.0, and public-domain grants, but the inspected head does not provide a machine-readable per-file license manifest. Consequently, exact coverage for every bundled font, tile, sound, and map cannot be established and default-free runtime behavior is not demonstrated. Unattended delivery is unsafe. This becomes unblocked only when a fixed upstream source provides a complete immutable origin for tween, explicit redistribution-compatible license grants for slam, shack, flux, tween, and every installed font and sound asset (including required attribution and share-alike obligations), HTTPS anonymous origins for all independently fetched sources, and a documented deterministic no-network runtime/smoke contract.

tay added the

state:blocked

label

2026-09-21 03:55:53 +00:00