From: "Ludovic Courtès" <ludo@gnu.org>
To: Christopher Baines <mail@cbaines.net>
Cc: 46829@debbugs.gnu.org
Subject: bug#46829: Fresh install of 1.2.0 can't guix pull
Date: Wed, 17 Mar 2021 15:36:44 +0100 [thread overview]
Message-ID: <877dm54zk3.fsf@gnu.org> (raw)
In-Reply-To: <877dmrtbvn.fsf@gnu.org> ("Ludovic Courtès"'s message of "Mon, 01 Mar 2021 11:19:08 +0100")
Hi,
Ludovic Courtès <ludo@gnu.org> skribis:
> Christopher Baines <mail@cbaines.net> skribis:
>
>> I believe there's TLS issues with pulling for the current 1.2.0 release.
>>
>> root@horna ~# guix pull
>> substitute: updating substitutes from 'https://guix.cbaines.net'... 100.0%
>> 0.0 MB will be downloaded
>> downloading from https://guix.cbaines.net/nar/lzip/zg72c146skpca45ijvjigqhqgx0mwiny-le-certs-0 ...
>> le-certs-0 4KiB 1.8MiB/s 00:00 [##################] 100.0%
>>
>> Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...
>> guix pull: error: Git error: the SSL certificate is invalid
>
> That’s on an installation without ‘nss-certs’ in the system profile,
> right?
Looking at (guix scripts pull), I think that is the case:
(define (honor-x509-certificates store)
"Use the right X.509 certificates for Git checkouts over HTTPS."
(unless (honor-system-x509-certificates!)
(honor-lets-encrypt-certificates! store)))
By default, 1.2.0 installs ‘nss-certs’, so I would assume such
installations are unaffected, right?
> I suppose we need to update the ‘le-certs’ package, or maybe skip X.509
> certification verification altogether for the ‘guix’ channel?
In hindsight, it seems preferable to keep X.509 authentication for now,
because there are still unauthenticated channels out there and because
it’s a bit tedious to work around it in (guix channels) and (guix git).
I checked the ‘le-certs’ package like so:
--8<---------------cut here---------------start------------->8---
$ guix gc --references $(guix build -d le-certs) |grep pem
/gnu/store/733k3s05nribnbbgc99w766gv7q36zgs-letsencryptauthorityx4.pem.drv
/gnu/store/92qqzmbfy72gs5knlpwrz8v2cf0fl1fs-isrgrootx1.pem.drv
/gnu/store/gm8rfnhlbvdql9dm43vag5p0lha56g4r-letsencryptauthorityx3.pem.drv
$ guix build --check -v1 $(guix gc --references $(guix build -d le-certs) |grep pem)
La jenaj derivoj estos konstruataj:
/gnu/store/gm8rfnhlbvdql9dm43vag5p0lha56g4r-letsencryptauthorityx3.pem.drv
/gnu/store/92qqzmbfy72gs5knlpwrz8v2cf0fl1fs-isrgrootx1.pem.drv
/gnu/store/733k3s05nribnbbgc99w766gv7q36zgs-letsencryptauthorityx4.pem.drv
building /gnu/store/92qqzmbfy72gs5knlpwrz8v2cf0fl1fs-isrgrootx1.pem.drv...
downloading from https://letsencrypt.org/certs/isrgrootx1.pem ...
|warning: rewriting hashes in `/gnu/store/hr94djs87lwgcyhz9ks3id3r1a4pgx2b-isrgrootx1.pem'; cross fingers
building /gnu/store/gm8rfnhlbvdql9dm43vag5p0lha56g4r-letsencryptauthorityx3.pem.drv...
downloading from https://letsencrypt.org/certs/letsencryptauthorityx3.pem ...
\warning: rewriting hashes in `/gnu/store/nfdm0gaa4s34aacr3jjp14wqynphkxcx-letsencryptauthorityx3.pem'; cross fingers
building /gnu/store/733k3s05nribnbbgc99w766gv7q36zgs-letsencryptauthorityx4.pem.drv...
downloading from https://letsencrypt.org/certs/letsencryptauthorityx4.pem ...
|warning: rewriting hashes in `/gnu/store/1ldg5q59n2qmq9qmbvyjnkjyxxjmflgh-letsencryptauthorityx4.pem'; cross fingers
/gnu/store/nfdm0gaa4s34aacr3jjp14wqynphkxcx-letsencryptauthorityx3.pem
/gnu/store/hr94djs87lwgcyhz9ks3id3r1a4pgx2b-isrgrootx1.pem
/gnu/store/1ldg5q59n2qmq9qmbvyjnkjyxxjmflgh-letsencryptauthorityx4.pem
--8<---------------cut here---------------end--------------->8---
AFAICS, everything is up-to-date here. So I don’t get where the ‘guix
pull’ error above comes from.
Ideas?
Ludo’.
next prev parent reply other threads:[~2021-03-17 15:17 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-28 10:27 bug#46829: Fresh install of 1.2.0 can't guix pull Christopher Baines
2021-02-28 11:06 ` Andreas Enge
2021-02-28 11:10 ` Andreas Enge
2021-03-01 10:15 ` Ludovic Courtès
2021-03-01 9:49 ` zimoun
2021-03-05 10:49 ` Christopher Baines
2021-03-01 10:19 ` Ludovic Courtès
2021-03-01 12:03 ` Andreas Enge
2021-03-17 14:36 ` Ludovic Courtès [this message]
2021-04-11 20:41 ` Leo Famulari
2021-04-12 1:29 ` Leo Famulari
2021-04-12 6:42 ` Leo Famulari
2021-04-12 8:30 ` Leo Famulari
2021-04-12 12:25 ` Ludovic Courtès
2021-04-12 17:15 ` Leo Famulari
2021-04-12 17:32 ` Leo Famulari
2021-04-13 8:12 ` Ludovic Courtès
2021-04-13 18:09 ` Leo Famulari
2021-04-21 13:14 ` Ludovic Courtès
2021-04-12 12:25 ` Ludovic Courtès
2021-04-12 17:02 ` Leo Famulari
2021-04-12 18:26 ` Leo Famulari
2021-04-13 17:47 ` Leo Famulari
2021-04-13 9:29 ` bug#46829: `guix pull` uses incorrect certificate store Ludovic Courtès
2021-04-13 17:44 ` Leo Famulari
2021-04-14 10:50 ` Ludovic Courtès
2021-04-14 19:57 ` Maxime Devos
2021-05-31 19:17 ` Leo Famulari
2021-04-10 19:02 ` bug#46829: Fresh install of 1.2.0 can't guix pull Leo Famulari
2021-04-10 19:45 ` Christopher Baines
2021-04-10 20:30 ` Leo Famulari
2021-04-10 21:09 ` Leo Famulari
2021-04-10 21:21 ` Christopher Baines
2021-04-10 22:54 ` Leo Famulari
2021-04-10 23:04 ` Leo Famulari
2021-04-10 23:13 ` Leo Famulari
2021-04-14 1:08 ` Leo Famulari
2021-04-14 9:44 ` François
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877dm54zk3.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=46829@debbugs.gnu.org \
--cc=mail@cbaines.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).