Fix build

build.sh

@@ -16,7 +16,17 @@ done
 [ -S /var/guix/daemon-socket/socket ] || { echo "guix-daemon failed to start" >&2; exit 1; }
 
 # Pull the pinned channels (updates ~/.config/guix/current).
-guix pull --channels=/workspace/channels.scm
+PULL_OK=0
+for attempt in $(seq 1 5); do
+  echo "guix pull: attempt ${attempt}/5"
+  if guix pull --channels=/workspace/channels.scm; then
+    PULL_OK=1
+    break
+  fi
+  echo "guix pull failed; retrying in 5s..."
+  sleep 5
+done
+[ "${PULL_OK}" = "1" ] || { echo "guix pull failed after retries" >&2; exit 1; }
 
 # Switch to the freshly pulled guix.
 export PATH="/root/.config/guix/current/bin:${PATH}"

channels.scm

@@ -2,7 +2,7 @@
 ;; bump the commit (or branch) here and rebuild.
 (list (channel
         (name 'guix)
-        (url "https://git.savannah.gnu.org/git/guix.git")
+        (url "https://codeberg.org/guix/guix.git")
         (branch "master")
         (commit "d759a1922126909b6097e245631669cf0b368b57")
         (introduction

main.go

@@ -44,7 +44,7 @@ func setup() *dagger.Container {
 		WithEnvVariable("DEBIAN_FRONTEND", "noninteractive").
 		WithExec([]string{"apt-get", "update"}).
 		WithExec([]string{"apt-get", "install", "-y", "--no-install-recommends",
-			"curl", "ca-certificates", "xz-utils", "gnupg", "passwd"}).
+			"curl", "ca-certificates", "xz-utils", "gnupg", "passwd", "netbase"}).
 		WithExec([]string{"curl", "-fsSL", "-o", "/tmp/" + tarball,
 			"https://ftp.gnu.org/gnu/guix/" + tarball}).
 		WithExec([]string{"tar", "-C", "/", "--warning=no-timestamp", "-xf", "/tmp/" + tarball}).
@@ -57,7 +57,8 @@ func (m *GuixIso) Build(ctx context.Context) *dagger.File {
 
 	return setup().
 		WithMountedDirectory("/workspace", src).
-		WithExec([]string{"bash", "/workspace/build.sh"}).
+		WithExec([]string{"bash", "/workspace/build.sh"},
+			dagger.ContainerWithExecOpts{InsecureRootCapabilities: true}).
 		File("/out/guix-install-" + arch + "-linux.iso")
 }