bug#22459: guix daemon writes acl to /etc/nix/acl not /etc/guix

bug#22459: guix daemon writes acl to /etc/nix/acl not /etc/guix

[Jeff Mickey]

On NixOS when I follow the binary installation instructions as of 0.9.0,
it places the acl in the wrong place.

guix archive --authorize < hydra.gnu.org.pub

This puts the file in /etc/nix/acl, not /etc/guix acl. This means the
guix daemon can't find the acl, and you build everything from scratch.

I solved this locally by making them a symlink.

Also, /gnu/store is set to only have 1770 permissions instead of 1774,
which means you can't use any of your guix symlinks with 0.9.0 :/

  //  codemac

bug#22459: guix daemon writes acl to /etc/nix/acl not /etc/guix

[Ludovic Courtès]

Jeff Mickey <j@codemac.net> skribis:

> On NixOS when I follow the binary installation instructions as of 0.9.0,
> it places the acl in the wrong place.
>
> guix archive --authorize < hydra.gnu.org.pub
>
> This puts the file in /etc/nix/acl, not /etc/guix acl. This means the
> guix daemon can't find the acl, and you build everything from scratch.

(guix pki) has:

--8<---------------cut here---------------start------------->8---
(define %acl-file
  (string-append %config-directory "/acl"))
--8<---------------cut here---------------end--------------->8---

where (guix config) does:

--8<---------------cut here---------------start------------->8---
(define %config-directory
  ;; This must match `NIX_CONF_DIR' as defined in `daemon.am'.
  (or (getenv "NIX_CONF_DIR") "@guix_sysconfdir@/guix"))
--8<---------------cut here---------------end--------------->8---

So most likely the ‘NIX_CONF_DIR’ environment variable is defined on
your system, and ‘guix archive’ simply honors that.

Can you confirm?

Now, we’ve honored those ‘NIX_’ variables mostly because the daemon
code, which comes from Nix, uses them, and I initially didn’t want to
diverge.  Nowadays it would probably make sense to rename them.

> Also, /gnu/store is set to only have 1770 permissions instead of 1774,

That’s not what I see:

--8<---------------cut here---------------start------------->8---
$ tar tvf guix-binary-0.9.0.x86_64-linux.tar.xz |grep /gnu/store/$
drwxrwxr-t root/root         0 1970-01-01 01:00 ./gnu/store/
--8<---------------cut here---------------end--------------->8---

Which installation method did you use?

> which means you can't use any of your guix symlinks with 0.9.0 :/

What do you mean by “your guix symlinks”?

Thanks,
Ludo’.

bug#22459: Guix tools should not honor NIX_* environment variables

[Ricardo Wurmus]

These NIX_* variables are still in use:

  NIX_AFFINITY_HACK
  NIX_BIN_DIR
  NIX_BUILD_CORES
  NIX_HELD_LOCKS
  NIX_IGNORE_SYMLINK_STORE
  NIX_STORE
  NIX_STORE_DIR

This is used internally:

  _NIX_OPTIONS

-- 
Ricardo

bug#22459: Guix tools should not honor NIX_* environment variables

[Ludovic Courtès]

Hi,

Ricardo Wurmus <rekado@elephly.net> skribis:

> These NIX_* variables are still in use:
>
>   NIX_AFFINITY_HACK
>   NIX_BIN_DIR
>   NIX_BUILD_CORES
>   NIX_HELD_LOCKS
>   NIX_IGNORE_SYMLINK_STORE
>   NIX_STORE
>   NIX_STORE_DIR

I think those used in the build environment, NIX_STORE and
NIX_BUILD_CORES at least, are here to stay; we could provide GUIX_
aliases though they couldn’t be relied on before some time.

Not sure about the others!

Thanks,
Ludo’.