Re: Drive identifiers

[myglc2]

On 01/18/2018 at 10:29 Danny Milosavljevic writes:

[...]

> Maybe we could make the user specify the serial number in the operating-system
> bootloader-configuration.  Installing the bootloader to the wrong
> drive would be very bad otherwise.  Also, it's not exactly declarative if the
> labels sda, sdb etc can move around - and reconfiguring / booting ends up like
> a game of musical chairs.
>
> Although if a drive fails and an administrator replaces it by a new drive,
> one would have to change the operating-system configuration and reconfigure
> (which could potentially download gigabytes of data and take hours).
>
> Not ideal.
>
> Maybe store the original serial number into a file on disk and make Guix
> fall back to checking those in a second pass (with a warning).
>
> (Guix could still call the bootloader's installer with the name of the
> device file it found out - so it wouldn't be an involved change)
>
> We would still have to check what happens with the hard drive emulators of
> CD-ROMs - do these have a unique persistent serial number?

Hi Danny,

I commented in a separate post on requiring our users to provide the
drive SN in the config file.  Here I comment on consequences of having
the SN of a HD in a file held by that HD. IMO this is like having the
directory name in a file held by the directory. Both raise the same
issue: the file is no longer relocatable.

In our case, as you point out, this creates a new error
case. Unfortunately we can't possibly know the best way to handle
it. E.G.: If the user has created an image backup of a mission-critical
GuixSD server and if they start it on a second server as a warm-backup
and if they have forgotten to change critical identify files (say
hostname) and if this can cause both servers to become corrupted,
halting on this error might be helpful. But first we should consider how
many "ifs" I used to construct this hypothetical downside. Maybe we are
protecting against very unlikely downsides.  Second: if we halt the user
may well say, "Yep, it's an image BU", override the error, and end up in
the same fix ;-) OTOH, if our user is feverishly trying to start the
image because the primary server failed, halting hurts the user. I
expect that, in practice, the latter case will be much more likely than
the former.

HTH - George