unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: 39819@debbugs.gnu.org
Subject: bug#39819: guix-service-type authorized keys are not honored when /etc/guix/acl exists
Date: Thu, 27 Feb 2020 23:30:33 -0500	[thread overview]
Message-ID: <87tv3bl4eu.fsf@apteryx.i-did-not-set--mail-host-address--so-tickle-me> (raw)

Hello,

I spent the evening debugging why my authorized keys for the
guix-service-type wouldn't appear under /etc/guix/acl upon
reconfiguration (and 'guix offload test' would be unhelpfully reporting
"guix offload: error: program
`/gnu/store/n9633hls7097236l4j8i1aiv5bppyf0q-guix-1.0.1-13.50299ad/bin/guix'
failed with exit code 1", see issue <https://bugs.gnu.org/34786>).

It turns out that the guix-activation script that is supposed to add the authorized keys does this:

--8<---------------cut here---------------start------------->8---
   (unless (file-exists? "/etc/guix/acl")
     (mkdir-p "/etc/guix")
     (copy-file #+default-acl "/etc/guix/acl")
     (chmod "/etc/guix/acl" #o600)))))
--8<---------------cut here---------------end--------------->8---

i.e., it doesn't do anything if a /etc/guix/acl file already exists.
This means that the only time it ought to do anything is the first time
the system was reconfigured (or perhaps, init?).

I would have expected the keys declared in my operating system
configuration to be used along those with /etc/guix/acl, or added to it.

Maxim

             reply	other threads:[~2020-02-28  4:31 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-02-28  4:30 Maxim Cournoyer [this message]
2020-02-28  4:32 ` bug#39819: guix-service-type authorized keys are not honored when /etc/guix/acl exists Maxim Cournoyer
     [not found] ` <87v9fhf3my.fsf@inria.fr>
2020-10-11 11:00   ` bug#39819: Declarative /etc/guix/acl? Efraim Flashner
     [not found]   ` <87k0vxaumm.fsf@gnu.org>
2020-10-12 12:53     ` Ludovic Courtès
     [not found]   ` <20201021150823.20508-1-ludo@gnu.org>
2020-10-21 15:08     ` bug#39819: [PATCH 2/2] doc: Add "Getting Substitutes from Other Servers" section Ludovic Courtès
     [not found]     ` <87tuujgr23.fsf@gnu.org>
2020-10-25  5:59       ` bug#39819: [PATCH 1/2] services: guix: Make /etc/guix/acl really declarative by default Jan Nieuwenhuizen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87tv3bl4eu.fsf@apteryx.i-did-not-set--mail-host-address--so-tickle-me \
    --to=maxim.cournoyer@gmail.com \
    --cc=39819@debbugs.gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).