bug#55500: guix.gnu.org is not available from Russia

bug#55500: guix.gnu.org is not available from Russia

[Zomb Hacker]

[-- Attachment #1: Type: text/plain, Size: 196 bytes --]

Greetings.
Website of the GNU Guix project is not available from Russia.
Is this a conscious decision based on the recent events, or the problem is
not on your side?
Best regards,
Yaryshev Alexey

[-- Attachment #2: Type: text/html, Size: 304 bytes --]

bug#55500: guix.gnu.org is not available from Russia

[Pavel Shlyak]

merge 55500 54370

> 18 мая 2022 г., в 17:19, Zomb Hacker <iceknight48@gmail.com> написал(а):
> 
> Greetings.
> Website of the GNU Guix project is not available from Russia.
> Is this a conscious decision based on the recent events, or the problem is not on your side?
> Best regards,
> Yaryshev Alexey

bug#55500: guix.gnu.org is not available from Russia

[Tobias Geerinckx-Rice via Bug reports for GNU Guix]

Hi Zomb,

Thanks for the report.  This is known, and one possible work-around is 
to use a VPN, or Tor: https://issues.guix.gnu.org/54370#13

I've merged these two bug reports.

As for the block itself, it was a conscious decision but not one made 
directly by the Guix maintainers.  The institute hosting the servers 
blocked Russian IP addresses after an increase in suspicious network 
activity.  As you say, probably due to ‘the recent events’.

Kind regards,

T G-R

Sent from a Web browser.  Excuse or enjoy my brevity.

bug#55500: guix.gnu.org is not available from Russia

[Tobias Geerinckx-Rice via Bug reports for GNU Guix]

Hasty reply, sorry if I miss a point.  [And in my hast I forgot to CC 
the list, sigh.  Here's another copy.]

On 2022-05-18 17:19, Zomb Hacker wrote:
> Is there any trusted mirrors?

Depends on what you mean by ‘trusted’, but yes.

For substitutes:
~~~~~~~~~~~~~~~~

- There's an independent but trusted build farm at 
"https://bordeaux.guix.gnu.org".  You can add this to your list of 
substitute URLs, *and* authorise its signing key[0], to make Guix poll 
it for substitutes instead of [or in addition to] ci.guix.gnu.org.

- There's also a Chinese mirror of ci.guix.gnu.org at 
"https://mirrors.sjtug.sjtu.edu.cn/guix".  This is a true mirror: it 
just serves whatever ci.guix.gnu.org does.
   This means that even though it's not run by the project, its 
substitutes will be signed with the ‘official’ ci.guix.gnu.org key, 
which your Guix trusts out of the box.  You don't need to authorise 
another key, and the SJTUG admins cannot modify & sign malicious 
binaries.

They can of course *see* what you download.  If you're worried about 
that, use Tor as explained by Ludovic.

For Guix ISOs
~~~~~~~~~~~~~

…the situation is less straightforward:

- ftp.gnu.org, which can be reached from Russia, hosts only releases, 
and Guix 1.3 is over a year old by this point.  It's supported, but…

- I recommend you download the equivalent to 
<https://guix.gnu.org/en/download/latest/> over Tor, even if that takes 
a while.

I also can't tell you how to easily add alternative substitute servers 
in the Guix installer itself, as I've never done so myself.  Sorry.

Kind regards,

T G-R

[0]: 
https://git.savannah.gnu.org/cgit/guix.git/plain/etc/substitutes/bordeaux.guix.gnu.org.pub