unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
From: "Ludovic Courtès" <ludo@gnu.org>
To: Christopher Baines <mail@cbaines.net>
Cc: 46829@debbugs.gnu.org
Subject: bug#46829: Fresh install of 1.2.0 can't guix pull
Date: Wed, 17 Mar 2021 15:36:44 +0100	[thread overview]
Message-ID: <877dm54zk3.fsf@gnu.org> (raw)
In-Reply-To: <877dmrtbvn.fsf@gnu.org> ("Ludovic Courtès"'s message of "Mon, 01 Mar 2021 11:19:08 +0100")

Hi,

Ludovic Courtès <ludo@gnu.org> skribis:

> Christopher Baines <mail@cbaines.net> skribis:
>
>> I believe there's TLS issues with pulling for the current 1.2.0 release.
>>
>> root@horna ~# guix pull
>> substitute: updating substitutes from 'https://guix.cbaines.net'... 100.0%
>> 0.0 MB will be downloaded
>> downloading from https://guix.cbaines.net/nar/lzip/zg72c146skpca45ijvjigqhqgx0mwiny-le-certs-0 ...
>>  le-certs-0  4KiB                                                                                                                                                           1.8MiB/s 00:00 [##################] 100.0%
>>
>> Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...
>> guix pull: error: Git error: the SSL certificate is invalid
>
> That’s on an installation without ‘nss-certs’ in the system profile,
> right?

Looking at (guix scripts pull), I think that is the case:

  (define (honor-x509-certificates store)
    "Use the right X.509 certificates for Git checkouts over HTTPS."
    (unless (honor-system-x509-certificates!)
      (honor-lets-encrypt-certificates! store)))

By default, 1.2.0 installs ‘nss-certs’, so I would assume such
installations are unaffected, right?

> I suppose we need to update the ‘le-certs’ package, or maybe skip X.509
> certification verification altogether for the ‘guix’ channel?

In hindsight, it seems preferable to keep X.509 authentication for now,
because there are still unauthenticated channels out there and because
it’s a bit tedious to work around it in (guix channels) and (guix git).

I checked the ‘le-certs’ package like so:

--8<---------------cut here---------------start------------->8---
$ guix gc --references $(guix build -d le-certs) |grep pem
/gnu/store/733k3s05nribnbbgc99w766gv7q36zgs-letsencryptauthorityx4.pem.drv
/gnu/store/92qqzmbfy72gs5knlpwrz8v2cf0fl1fs-isrgrootx1.pem.drv
/gnu/store/gm8rfnhlbvdql9dm43vag5p0lha56g4r-letsencryptauthorityx3.pem.drv
$ guix build --check -v1 $(guix gc --references $(guix build -d le-certs) |grep pem)
La jenaj derivoj estos konstruataj:
   /gnu/store/gm8rfnhlbvdql9dm43vag5p0lha56g4r-letsencryptauthorityx3.pem.drv
   /gnu/store/92qqzmbfy72gs5knlpwrz8v2cf0fl1fs-isrgrootx1.pem.drv
   /gnu/store/733k3s05nribnbbgc99w766gv7q36zgs-letsencryptauthorityx4.pem.drv

building /gnu/store/92qqzmbfy72gs5knlpwrz8v2cf0fl1fs-isrgrootx1.pem.drv...
downloading from https://letsencrypt.org/certs/isrgrootx1.pem ...
|warning: rewriting hashes in `/gnu/store/hr94djs87lwgcyhz9ks3id3r1a4pgx2b-isrgrootx1.pem'; cross fingers
building /gnu/store/gm8rfnhlbvdql9dm43vag5p0lha56g4r-letsencryptauthorityx3.pem.drv...
downloading from https://letsencrypt.org/certs/letsencryptauthorityx3.pem ...
\warning: rewriting hashes in `/gnu/store/nfdm0gaa4s34aacr3jjp14wqynphkxcx-letsencryptauthorityx3.pem'; cross fingers
building /gnu/store/733k3s05nribnbbgc99w766gv7q36zgs-letsencryptauthorityx4.pem.drv...
downloading from https://letsencrypt.org/certs/letsencryptauthorityx4.pem ...
|warning: rewriting hashes in `/gnu/store/1ldg5q59n2qmq9qmbvyjnkjyxxjmflgh-letsencryptauthorityx4.pem'; cross fingers
/gnu/store/nfdm0gaa4s34aacr3jjp14wqynphkxcx-letsencryptauthorityx3.pem
/gnu/store/hr94djs87lwgcyhz9ks3id3r1a4pgx2b-isrgrootx1.pem
/gnu/store/1ldg5q59n2qmq9qmbvyjnkjyxxjmflgh-letsencryptauthorityx4.pem
--8<---------------cut here---------------end--------------->8---

AFAICS, everything is up-to-date here.  So I don’t get where the ‘guix
pull’ error above comes from.

Ideas?

Ludo’.




  parent reply	other threads:[~2021-03-17 15:17 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-28 10:27 bug#46829: Fresh install of 1.2.0 can't guix pull Christopher Baines
2021-02-28 11:06 ` Andreas Enge
2021-02-28 11:10 ` Andreas Enge
2021-03-01 10:15   ` Ludovic Courtès
2021-03-01  9:49 ` zimoun
2021-03-05 10:49   ` Christopher Baines
2021-03-01 10:19 ` Ludovic Courtès
2021-03-01 12:03   ` Andreas Enge
2021-03-17 14:36   ` Ludovic Courtès [this message]
2021-04-11 20:41     ` Leo Famulari
2021-04-12  1:29       ` Leo Famulari
2021-04-12  6:42         ` Leo Famulari
2021-04-12  8:30           ` Leo Famulari
2021-04-12 12:25             ` Ludovic Courtès
2021-04-12 17:15               ` Leo Famulari
2021-04-12 17:32                 ` Leo Famulari
2021-04-13  8:12                   ` Ludovic Courtès
2021-04-13 18:09                     ` Leo Famulari
2021-04-21 13:14                       ` Ludovic Courtès
2021-04-12 12:25             ` Ludovic Courtès
2021-04-12 17:02               ` Leo Famulari
2021-04-12 18:26                 ` Leo Famulari
2021-04-13 17:47                   ` Leo Famulari
2021-04-13  9:29           ` bug#46829: `guix pull` uses incorrect certificate store Ludovic Courtès
2021-04-13 17:44             ` Leo Famulari
2021-04-14 10:50               ` Ludovic Courtès
2021-04-14 19:57                 ` Maxime Devos
2021-05-31 19:17                 ` Leo Famulari
2021-04-10 19:02 ` bug#46829: Fresh install of 1.2.0 can't guix pull Leo Famulari
2021-04-10 19:45   ` Christopher Baines
2021-04-10 20:30     ` Leo Famulari
2021-04-10 21:09       ` Leo Famulari
2021-04-10 21:21         ` Christopher Baines
2021-04-10 22:54           ` Leo Famulari
2021-04-10 23:04 ` Leo Famulari
2021-04-10 23:13 ` Leo Famulari
2021-04-14  1:08 ` Leo Famulari
2021-04-14  9:44   ` François

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=877dm54zk3.fsf@gnu.org \
    --to=ludo@gnu.org \
    --cc=46829@debbugs.gnu.org \
    --cc=mail@cbaines.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).