bug#33603: Invalid hash for NSS-Certs

bug#33603: Invalid hash for NSS-Certs

[Brett Gilio]

Generation 10	Dec 03 2018 11:42:41	(current)
  guix 4f03aa2
    repository URL: https://git.savannah.gnu.org/git/guix.git
    branch: master
    commit: 4f03aa23e805bd653de774e1d74ed2f50826899b

downloading from https://mirror.hydra.gnu.org/guix/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39...
 nss-certs-3.39  145KiB               417KiB/s 00:00 [##################] 100.0%

sha256 hash mismatch for /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39:
  expected hash: 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
  actual hash:   08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s
substitution of /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 failed

bug#33603: Invalid hash for NSS-Certs

[Ludovic Courtès]

Hi Brett,

Brett Gilio <brettg@posteo.net> skribis:

> Generation 10	Dec 03 2018 11:42:41	(current)
>   guix 4f03aa2
>     repository URL: https://git.savannah.gnu.org/git/guix.git
>     branch: master
>     commit: 4f03aa23e805bd653de774e1d74ed2f50826899b
>
> downloading from https://mirror.hydra.gnu.org/guix/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39...
>  nss-certs-3.39  145KiB               417KiB/s 00:00 [##################] 100.0%
>
> sha256 hash mismatch for /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39:
>   expected hash: 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
>   actual hash:   08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s
> substitution of /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 failed

The problem seems to be gone because I’m seeing the right hash here:

--8<---------------cut here---------------start------------->8---
$ wget -q -O - https://mirror.hydra.gnu.org/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 |gunzip -c |guix hash -
101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
$ wget -q -O - https://mirror.hydra.gnu.org/xbj4fhad0lnz0ziflwi90gyqbls8ains.narinfo |grep Hash
NarHash: sha256:101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
--8<---------------cut here---------------end--------------->8---

Could you try again?

However berlin.guixsd.org is publishing the one with hash
08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s, and the difference
is an encoding bug:

--8<---------------cut here---------------start------------->8---
$ diff -ru /tmp/nss-certs.{hydra,berlin}
Only in /tmp/nss-certs.hydra/etc/ssl/certs: AC_Raíz_Certicámara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem
Only in /tmp/nss-certs.berlin/etc/ssl/certs: AC_Ra?z_Certic?mara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem
Only in /tmp/nss-certs.hydra/etc/ssl/certs: NetLock_Arany_=Class_Gold=_Főtanúsítvány:2.6.73.65.44.228.0.16.pem
Only in /tmp/nss-certs.berlin/etc/ssl/certs: NetLock_Arany_=Class_Gold=_F?tan?s?tv?ny:2.6.73.65.44.228.0.16.pem
--8<---------------cut here---------------end--------------->8---

(Probably related to <https://issues.guix.info/issue/32942>.)

Ludo’.

bug#33603: Invalid hash for NSS-Certs

[maxim.cournoyer]

ludo@gnu.org (Ludovic Courtès) writes:

> Hi Brett,
>
> Brett Gilio <brettg@posteo.net> skribis:
>
>> Generation 10	Dec 03 2018 11:42:41	(current)
>>   guix 4f03aa2
>>     repository URL: https://git.savannah.gnu.org/git/guix.git
>>     branch: master
>>     commit: 4f03aa23e805bd653de774e1d74ed2f50826899b
>>
>> downloading from https://mirror.hydra.gnu.org/guix/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39...
>>  nss-certs-3.39  145KiB               417KiB/s 00:00 [##################] 100.0%
>>
>> sha256 hash mismatch for /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39:
>>   expected hash: 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
>>   actual hash:   08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s
>> substitution of /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 failed
>
> The problem seems to be gone because I’m seeing the right hash here:
>
> $ wget -q -O - https://mirror.hydra.gnu.org/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 |gunzip -c |guix hash -
> 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
> $ wget -q -O - https://mirror.hydra.gnu.org/xbj4fhad0lnz0ziflwi90gyqbls8ains.narinfo |grep Hash
> NarHash: sha256:101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla

I got the failure while trying to reconfigure:

--8<---------------cut here---------------start------------->8---
downloading from https://mirror.hydra.gnu.org/guix/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39...
 nss-certs-3.39  145KiB                                                      608KiB/s 00:00 [##################] 100.0%

sha256 hash mismatch for /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39:
  expected hash: 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
  actual hash:   08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s
substitution of
  /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 failed
--8<---------------cut here---------------end--------------->8---

Maxim

bug#33603: Invalid hash for NSS-Certs

[Ludovic Courtès]

maxim.cournoyer@gmail.com skribis:

> ludo@gnu.org (Ludovic Courtès) writes:
>
>> Hi Brett,
>>
>> Brett Gilio <brettg@posteo.net> skribis:
>>
>>> Generation 10	Dec 03 2018 11:42:41	(current)
>>>   guix 4f03aa2
>>>     repository URL: https://git.savannah.gnu.org/git/guix.git
>>>     branch: master
>>>     commit: 4f03aa23e805bd653de774e1d74ed2f50826899b
>>>
>>> downloading from https://mirror.hydra.gnu.org/guix/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39...
>>>  nss-certs-3.39  145KiB               417KiB/s 00:00 [##################] 100.0%
>>>
>>> sha256 hash mismatch for /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39:
>>>   expected hash: 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
>>>   actual hash:   08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s
>>> substitution of /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 failed
>>
>> The problem seems to be gone because I’m seeing the right hash here:
>>
>> $ wget -q -O - https://mirror.hydra.gnu.org/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 |gunzip -c |guix hash -
>> 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
>> $ wget -q -O - https://mirror.hydra.gnu.org/xbj4fhad0lnz0ziflwi90gyqbls8ains.narinfo |grep Hash
>> NarHash: sha256:101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
>
> I got the failure while trying to reconfigure:
>
> downloading from https://mirror.hydra.gnu.org/guix/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39...
>  nss-certs-3.39  145KiB                                                      608KiB/s 00:00 [##################] 100.0%
>
> sha256 hash mismatch for /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39:
>   expected hash: 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
>   actual hash:   08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s
> substitution of
>   /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 failed

The wget commands above still give me the correct result, with hash
101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla.

Are you running Guix on a foreign distro?  If so, could it be that
guix-daemon is effectively running in the C locale?

Thanks,
Ludo’.

bug#33603: Invalid hash for NSS-Certs

[Maxim Cournoyer]

Hello!

Ludovic Courtès <ludo@gnu.org> writes:
[...]
> The wget commands above still give me the correct result, with hash
> 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla.
>
> Are you running Guix on a foreign distro?  If so, could it be that
> guix-daemon is effectively running in the C locale?

This is a good guess, and we've seen this very issue before. I am using
GuixSD. I had to use --fallback to work around it.

I've digged a little bit:
--8<---------------cut here---------------start------------->8---
$ wget -q -O - https://mirror.hydra.gnu.org/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 | gunzip | guix archive -x /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra

$ guix hash -r /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra
101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla

$ guix build nss-certs
/gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39

$ guix hash -r /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s

$ diff -r /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
Only in /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra/etc/ssl/certs: AC_Raíz_Certicámara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem
Only in /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39/etc/ssl/certs: AC_Ra?z_Certic?mara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem
Only in /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra/etc/ssl/certs: NetLock_Arany_=Class_Gold=_Főtanúsítvány:2.6.73.65.44.228.0.16.pem
Only in
/gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39/etc/ssl/certs:
NetLock_Arany_=Class_Gold=_F?tan?s?tv?ny:2.6.73.65.44.228.0.16.pem
--8<---------------cut here---------------end--------------->8---

It's a rather old install (late 2016 -- but kept up-to-date, of course
:-)) so there might be remnants from the past?  How could I verify in
which locale the guix-daemon is running?

Thanks!

Maxim

bug#33603: Invalid hash for NSS-Certs

[Ludovic Courtès]

Hi!

Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
> [...]
>> The wget commands above still give me the correct result, with hash
>> 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla.
>>
>> Are you running Guix on a foreign distro?  If so, could it be that
>> guix-daemon is effectively running in the C locale?
>
> This is a good guess, and we've seen this very issue before. I am using
> GuixSD. I had to use --fallback to work around it.
>
> I've digged a little bit:
>
> $ wget -q -O - https://mirror.hydra.gnu.org/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39 | gunzip | guix archive -x /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra
>
> $ guix hash -r /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra
> 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
>
> $ guix build nss-certs
> /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
>
> $ guix hash -r /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
> 08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s
>
> $ diff -r /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
> Only in /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra/etc/ssl/certs: AC_Raíz_Certicámara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem
> Only in /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39/etc/ssl/certs: AC_Ra?z_Certic?mara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem
> Only in /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra/etc/ssl/certs: NetLock_Arany_=Class_Gold=_Főtanúsítvány:2.6.73.65.44.228.0.16.pem
> Only in
> /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39/etc/ssl/certs:
> NetLock_Arany_=Class_Gold=_F?tan?s?tv?ny:2.6.73.65.44.228.0.16.pem
>
> It's a rather old install (late 2016 -- but kept up-to-date, of course
> :-)) so there might be remnants from the past?  How could I verify in
> which locale the guix-daemon is running?

You could check /proc/$(pidof guix-daemon)/environ for variables like
‘LC_ALL’.  And of course, you can see if ‘guix substitute’ emits the
infamous “can’t install locale” message.  :-)

Regardless, I think ‘guix substitute’ should ideally be
locale-insensitive, or it should error out rather than produce files
with the wrong names.

HTH,
Ludo’.

bug#33603: Invalid hash for NSS-Certs

[Maxim Cournoyer]

Hello!

Ludovic Courtès <ludo@gnu.org> writes:

> Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:

[...]

>> It's a rather old install (late 2016 -- but kept up-to-date, of course
>> :-)) so there might be remnants from the past?  How could I verify in
>> which locale the guix-daemon is running?
>
> You could check /proc/$(pidof guix-daemon)/environ for variables like
> ‘LC_ALL’.  And of course, you can see if ‘guix substitute’ emits the
> infamous “can’t install locale” message.  :-)
>
> Regardless, I think ‘guix substitute’ should ideally be
> locale-insensitive, or it should error out rather than produce files
> with the wrong names.

The only environment variable(s?) defined for the guix-daemon process on
that machine is:

--8<---------------cut here---------------start------------->8---
$ pidof guix-daemon
270

sudo cat /proc/270/environ
GUIX_LOCPATH=/gnu/store/94k5w17z54w25lgp90czdqfv9m4hwzhq-glibc-utf8-locales-2.28/lib/localeLC_ALL=en_US.utf8
--8<---------------cut here---------------end--------------->8---

I'm not familiar with this systemfs structure, but shouldn't there be a
newline before the LC_ALL=en_US.utf8 variable assignment?

It's the same on a 2nd GuixSD machine.

--8<---------------cut here---------------start------------->8---
$ sudo guix substitute --help
# Usage: guix substitute [OPTION]...
...
--8<---------------cut here---------------end--------------->8---

No infamous locale error here.

Not sure what happened here :-/

Maxim

bug#33603: Invalid hash for NSS-Certs

[Ludovic Courtès]

Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:

> Hello!
>
> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:
>
> [...]
>
>>> It's a rather old install (late 2016 -- but kept up-to-date, of course
>>> :-)) so there might be remnants from the past?  How could I verify in
>>> which locale the guix-daemon is running?
>>
>> You could check /proc/$(pidof guix-daemon)/environ for variables like
>> ‘LC_ALL’.  And of course, you can see if ‘guix substitute’ emits the
>> infamous “can’t install locale” message.  :-)
>>
>> Regardless, I think ‘guix substitute’ should ideally be
>> locale-insensitive, or it should error out rather than produce files
>> with the wrong names.
>
> The only environment variable(s?) defined for the guix-daemon process on
> that machine is:
>
> $ pidof guix-daemon
> 270
>
> sudo cat /proc/270/environ
> GUIX_LOCPATH=/gnu/store/94k5w17z54w25lgp90czdqfv9m4hwzhq-glibc-utf8-locales-2.28/lib/localeLC_ALL=en_US.utf8

This is perfect (see commit 7e4bc215098f334bc2a11737f2665dd4992fc2da,
which gave you this, fixing the issue we’re talking about on GuixSD.)

So I don’t think this machine has any problem.  Perhaps nss-certs was
installed before the fix above?

> I'm not familiar with this systemfs structure, but shouldn't there be a
> newline before the LC_ALL=en_US.utf8 variable assignment?

No, there are actually newlines, try:

  cat /proc/270/environ | xargs -0 echo

HTH,
Ludo’.

bug#33603: Invalid hash for NSS-Certs

[Maxim Cournoyer]

Hi Ludovic!

Ludovic Courtès <ludo@gnu.org> writes:

> Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:

[...]

>> The only environment variable(s?) defined for the guix-daemon process on
>> that machine is:
>>
>> $ pidof guix-daemon
>> 270
>>
>> sudo cat /proc/270/environ
>> GUIX_LOCPATH=/gnu/store/94k5w17z54w25lgp90czdqfv9m4hwzhq-glibc-utf8-locales-2.28/lib/localeLC_ALL=en_US.utf8
>
> This is perfect (see commit 7e4bc215098f334bc2a11737f2665dd4992fc2da,
> which gave you this, fixing the issue we’re talking about on GuixSD.)
>
> So I don’t think this machine has any problem.  Perhaps nss-certs was
> installed before the fix above?

Yes, that is likely the cause! I think I was using a system generation
from November to cope with some network instabilities I had at the
time. These have been resolved since :-).

>> I'm not familiar with this systemfs structure, but shouldn't there be a
>> newline before the LC_ALL=en_US.utf8 variable assignment?
>
> No, there are actually newlines, try:
>
>   cat /proc/270/environ | xargs -0 echo

Indeed. Thanks for continuously helping me to refine my knowledge ^^.

Shall we close this ticket, or did you want to keep it until we make
guix substitute fail when the locale of the daemon is not set to a UTF-8
based one?

Thank you!

Maxim

bug#33603: Invalid hash for NSS-Certs

[Ludovic Courtès]

Hi Maxim,

Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:

> Shall we close this ticket, or did you want to keep it until we make
> guix substitute fail when the locale of the daemon is not set to a UTF-8
> based one?

Commit 9fe3f11398e858f1d06120bd046cab506efc86dc does that.
Done!

Ludo’.

bug#33603: Invalid hash for NSS-Certs

[Maxim Cournoyer]

Ludovic Courtès <ludo@gnu.org> writes:

> Hi Maxim,
>
> Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:
>
>> Shall we close this ticket, or did you want to keep it until we make
>> guix substitute fail when the locale of the daemon is not set to a UTF-8
>> based one?
>
> Commit 9fe3f11398e858f1d06120bd046cab506efc86dc does that.
> Done!
>
> Ludo’.

That was quick! Well done! :-)

Maxim