bug#47470: missing source crypto++

bug#47470: missing source crypto++

[zimoun]

Hi,

Using Guix 55685e4, I get:

--8<---------------cut here---------------start------------->8---
$ guix build -S --no-substitutes crypto++
The following derivations will be built:
   /gnu/store/ygm0vj16131ki4dp19g07r9qva96na6z-cryptopp840.zip.drv
   /gnu/store/ak8srnbal72rvkl646j5p9ylf39m60md-unzip-6.0.drv
   /gnu/store/ckxh9dx7nf9mx0vkr6a7y8biwxisgqpv-unzip60.tar.xz.drv
   /gnu/store/ss5klqhzwavdy1r7xr5x4fpiwabv74gc-unzip60.tar.gz.drv
   /gnu/store/h43wi0jqkg13dsmc51d3bjmbzwrvgpq5-zipbomb-cryptopp840.zip.drv
building /gnu/store/h43wi0jqkg13dsmc51d3bjmbzwrvgpq5-zipbomb-cryptopp840.zip.drv...

Starting download of
/gnu/store/8dvs6mdlkgfjpyyislj7mhym329z53ww-zipbomb-cryptopp840.zip
From https://cryptopp.com/cryptopp840.zip...
In procedure connect*: No route to host

Starting download of
/gnu/store/8dvs6mdlkgfjpyyislj7mhym329z53ww-zipbomb-cryptopp840.zip
From https://ci.guix.gnu.org/file/zipbomb-cryptopp840.zip/sha256/16kvfm11xv7j9a3yykzysjgw38a9b7lnc5n5x5h82g395k6ybxf0...
download failed
"https://ci.guix.gnu.org/file/zipbomb-cryptopp840.zip/sha256/16kvfm11xv7j9a3yykzysjgw38a9b7lnc5n5x5h82g395k6ybxf0"
404 "Not Found"

Starting download of
/gnu/store/8dvs6mdlkgfjpyyislj7mhym329z53ww-zipbomb-cryptopp840.zip
From https://tarballs.nixos.org/sha256/16kvfm11xv7j9a3yykzysjgw38a9b7lnc5n5x5h82g395k6ybxf0...
download failed
"https://tarballs.nixos.org/sha256/16kvfm11xv7j9a3yykzysjgw38a9b7lnc5n5x5h82g395k6ybxf0"
404 "Not Found"

Starting download of
/gnu/store/8dvs6mdlkgfjpyyislj7mhym329z53ww-zipbomb-cryptopp840.zip
From https://archive.softwareheritage.org/api/1/content/sha256:c0f5e5cd2c693c8160e9c51666e95949a1c19fd4fe4fef874af2ec1e42757b9a/raw/...
download failed
"https://archive.softwareheritage.org/api/1/content/sha256:c0f5e5cd2c693c8160e9c51666e95949a1c19fd4fe4fef874af2ec1e42757b9a/raw/"
404 "Not Found"
failed to download
"/gnu/store/8dvs6mdlkgfjpyyislj7mhym329z53ww-zipbomb-cryptopp840.zip"
from "https://cryptopp.com/cryptopp840.zip"
builder for `/gnu/store/h43wi0jqkg13dsmc51d3bjmbzwrvgpq5-zipbomb-cryptopp840.zip.drv'
failed to produce output path
`/gnu/store/8dvs6mdlkgfjpyyislj7mhym329z53ww-zipbomb-cryptopp840.zip'
build of /gnu/store/h43wi0jqkg13dsmc51d3bjmbzwrvgpq5-zipbomb-cryptopp840.zip.drv
failed
View build log at
'/var/log/guix/drvs/h4/3wi0jqkg13dsmc51d3bjmbzwrvgpq5-zipbomb-cryptopp840.zip.drv.bz2'.
cannot build derivation
`/gnu/store/ygm0vj16131ki4dp19g07r9qva96na6z-cryptopp840.zip.drv': 1
dependencies couldn't be built
guix build: error: build of
`/gnu/store/ygm0vj16131ki4dp19g07r9qva96na6z-cryptopp840.zip.drv'
failed
--8<---------------cut here---------------end--------------->8---

The easy fix is to replace by <https://github.com/weidai11/cryptopp>;
keeping url-fetch or replacing by git-fetch.


All the best,
simon

bug#47470: [PATCH] gnu: crypto++: Update to 8.5.0.

[Leo Prikler]

* gnu/packages/crypto.scm (crypto++): Update to 8.5.0.
[origin]: Use git-fetch and git-reference.
---
 gnu/packages/crypto.scm | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/gnu/packages/crypto.scm b/gnu/packages/crypto.scm
index 94f9cbeebf..57d417de80 100644
--- a/gnu/packages/crypto.scm
+++ b/gnu/packages/crypto.scm
@@ -773,15 +773,18 @@ data on your platform, so the seed itself will be as random as possible.
 (define-public crypto++
   (package
     (name "crypto++")
-    (version "8.4.0")
+    (version "8.5.0")
     (source (origin
-              (method url-fetch/zipbomb)
-              (uri (string-append "https://cryptopp.com/cryptopp"
-                                  (string-join (string-split version #\.) "")
-                                  ".zip"))
+              (method git-fetch)
+              (uri
+               (git-reference
+                (url "https://github.com/weidai11/cryptopp")
+                (commit
+                 (string-append "CRYPTOPP_"
+                                (string-replace-substring version "." "_")))))
               (sha256
                (base32
-                "16kvfm11xv7j9a3yykzysjgw38a9b7lnc5n5x5h82g395k6ybxf0"))))
+                "0in7rlazq91vfi519g9wr7bh87hii47cimxv7fmj0f88vhjaidq3"))))
     (build-system gnu-build-system)
     (arguments
      `(#:make-flags
-- 
2.31.0

bug#47470: bug#47477: [PATCH] gnu: crypto++: Update to 8.5.0.

[Leo Prikler]

Am Montag, den 05.04.2021, 11:47 +0200 schrieb Ludovic Courtès:
> Hi Leo,
> 
> Leo Prikler <leo.prikler@student.tugraz.at> skribis:
> 
> > * gnu/packages/crypto.scm (crypto++): Update to 8.5.0.
> > [origin]: Use git-fetch and git-reference.
> 
> If dependents still build fine, go for it!
> 
> Thanks,
> Ludo’.
Built everything locally and pushed.  Hopefully the CI doesn't notice,
that I only checked amd64 :)

bug#47470: missing source crypto++

[Leo Famulari]

On Mon, Mar 29, 2021 at 05:17:31PM +0200, zimoun wrote:
> The easy fix is to replace by <https://github.com/weidai11/cryptopp>;
> keeping url-fetch or replacing by git-fetch.

I saw you used --no-substitutes. Did you try requesting a substitute for
the source code?

Anyways, the cryptopp.com site was online as recently as March 26, only
3 days ago.

https://web.archive.org/web/20210326063427/https://www.cryptopp.com/

It's being discussed upstream:

https://github.com/weidai11/cryptopp/issues/1022

Maybe we should just wait a few hours before changing the source of the
package.

bug#47470: missing source crypto++

[zimoun]

Hi Leo,

On Mon, 29 Mar 2021 at 18:33, Leo Famulari <leo@famulari.name> wrote:

> I saw you used --no-substitutes. Did you try requesting a substitute for
> the source code?

With substitutes, "guix build -S" fetch the source from Berlin.
With --no-substitutes, it fetches from upstream.

Do I miss something?

> Anyways, the cryptopp.com site was online as recently as March 26, only
> 3 days ago.
>
> https://web.archive.org/web/20210326063427/https://www.cryptopp.com/
>
> It's being discussed upstream:
>
> https://github.com/weidai11/cryptopp/issues/1022
>
> Maybe we should just wait a few hours before changing the source of the
> package.

Yes for sure.  Or even a few days. ;-)

All the best,
simon