bug#70243: The substitute authorization warning is displayed when it shouldn't be

bug#70243: The substitute authorization warning is displayed when it shouldn't be

[Leo Famulari]

I just saw this on Debian:

------
$ guix shell -D guix -- ./pre-inst-env guix weather linux-libre
computing 1 package derivations for x86_64-linux...
looking for 1 store items on https://ci.guix.gnu.org...
guix weather: warning: substitutes from 'https://ci.guix.gnu.org' are unauthorized
hint: To authorize all substitutes from `https://ci.guix.gnu.org' to be downloaded, the following command needs to be run as root:
[...]
------

But, I do have the given key in my '/etc/guix/acl', and this works:

------
guix shell -D guix -- ./pre-inst-env guix build linux-libre       
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
substitute: updating substitutes from 'https://bordeaux.guix.gnu.org'... 100.0%
114.0 MB will be downloaded:
  /gnu/store/547y21y3w9nj29w9n73gp2arjxgmvvl6-linux-libre-6.8.2
substituting /gnu/store/547y21y3w9nj29w9n73gp2arjxgmvvl6-linux-libre-6.8.2...
[...]
------

So, the warning is mistaken.

For your reference:

------
guix shell -D guix -- ./pre-inst-env guix describe         
Git checkout:                                                  
  repository: /home/leo/work/guix/
  branch: master
  commit: 50a72a08af37557575199b56bbee9f334d58575a
------

Let me know if there is any other information I can provide.

bug#70243: The substitute authorization warning is displayed when it shouldn't be

[Ludovic Courtès]

Hi Leo,

Leo Famulari <leo@famulari.name> skribis:

> I just saw this on Debian:
>
> ------
> $ guix shell -D guix -- ./pre-inst-env guix weather linux-libre
> computing 1 package derivations for x86_64-linux...
> looking for 1 store items on https://ci.guix.gnu.org...
> guix weather: warning: substitutes from 'https://ci.guix.gnu.org' are unauthorized
> hint: To authorize all substitutes from `https://ci.guix.gnu.org' to be downloaded, the following command needs to be run as root:
> [...]
> ------
>
> But, I do have the given key in my '/etc/guix/acl', and this works:

Are /etc/guix/acl and /etc/guix world-readable?

‘check-narinfo-authorization’ in (guix scripts weather) is supposed to
properly handle this case, but I think that fails if /etc/guix is not
accessible.

Thanks,
Ludo’.

bug#70243: The substitute authorization warning is displayed when it shouldn't be

[Simon Tournier]

[-- Attachment #1: Type: text/plain, Size: 339 bytes --]

Hi,

On Sat, 25 May 2024 at 11:31, Ludovic Courtès <ludo@gnu.org> wrote:

>> But, I do have the given key in my '/etc/guix/acl', and this works:
>
> Are /etc/guix/acl and /etc/guix world-readable?

I had been bitten by this recently.  And I have not found any mention
about that in the manual.  Maybe it could helpful to add:


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: p.patch --]
[-- Type: text/x-diff, Size: 496 bytes --]

diff --git a/doc/guix.texi b/doc/guix.texi
index 5e1173b8c6..3b97674733 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -3792,7 +3792,8 @@ Getting Substitutes from Other Servers
 @end example
 
 Again this assumes @file{key.pub} contains the public key that
-@code{guix.example.org} uses to sign substitutes.
+@code{guix.example.org} uses to sign substitutes.  Make sure
+@file{/etc/guix/acl} is world-readable.
 @end enumerate
 
 Now you're all set!  Substitutes will be preferably taken from

[-- Attachment #3: Type: text/plain, Size: 144 bytes --]



In addition, I had to be read a comment in source code to know what
another issue was: the daemon’s too old.  Hence, I would suggest:


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #4: pp.patch --]
[-- Type: text/x-diff, Size: 657 bytes --]

diff --git a/guix/scripts/weather.scm b/guix/scripts/weather.scm
index 08a1b22a74..98a09f9e9a 100644
--- a/guix/scripts/weather.scm
+++ b/guix/scripts/weather.scm
@@ -643,7 +643,7 @@ (define-command (guix-weather . args)
                              ;; substitute URLs, presumably because it's too
                              ;; old.
                              (warning (G_ "using default \
-substitute URLs~%"))
+substitute URLs; maybe the daemon's too old~%"))
                              %default-substitute-urls)))
              (systems  (match (filter-map (match-lambda
                                             (('system . system) system)

[-- Attachment #5: Type: text/plain, Size: 93 bytes --]


Both would ease the debugging session of substitute authorization, IMHO.

Cheers,
simon