bug#35561: Fresh install, guix pull exits with error, hash mismatch

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Calle Kabo]

[-- Attachment #1: Type: text/plain, Size: 2746 bytes --]

manager@guix ~$ guix pullMigrating profile generations to '/var/guix/profiles/per-user/manager'...substitute: updating substitutes from 'https://ci.guix.gnu.org <https://ci.guix.gnu.org>'... 100.0%substitute: updating substitutes from 'https://ci.guix.gnu.org <https://ci.guix.gnu.org>'... 100.0%downloading from https://ci.guix.gnu.org/nar/gzip/1drx7dy1zakc0xs60nb0im1jbvxp11dj-isrgrootx1.pem <https://ci.guix.gnu.org/nar/gzip/1drx7dy1zakc0xs60nb0im1jbvxp11dj-isrgrootx1.pem>... isrgrootx1.pem  2KiB                                                                             634KiB/s 00:00 [##################] 100.0%downloading from https://ci.guix.gnu.org/nar/gzip/zh3s89l1kri7r5ya0bmhil65lm0my691-module-import <https://ci.guix.gnu.org/nar/gzip/zh3s89l1kri7r5ya0bmhil65lm0my691-module-import>... module-import  187B                                                                               81KiB/s 00:00 [##################] 100.0%downloading from https://ci.guix.gnu.org/nar/gzip/yl1vi61qmvvh83amwiwaik7s7jc03n5z-openssl-1.0.2p <https://ci.guix.gnu.org/nar/gzip/yl1vi61qmvvh83amwiwaik7s7jc03n5z-openssl-1.0.2p>... openssl-1.0.2p  2.2MiB                                                                           2.3MiB/s 00:01 [##################] 100.0%downloading from https://ci.guix.gnu.org/nar/gzip/lz72i155jfq364n97qgd6f2rj02mm7y1-module-import-compiled <https://ci.guix.gnu.org/nar/gzip/lz72i155jfq364n97qgd6f2rj02mm7y1-module-import-compiled>... module-import-compiled  45KiB                                                                    757KiB/s 00:00 [##################] 100.0%building /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv...downloading from https://letsencrypt.org/certs/letsencryptauthorityx3.pem <https://letsencrypt.org/certs/letsencryptauthorityx3.pem>...|sha256 hash mismatch for /gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem:  expected hash: 0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk  actual hash:   1kvac1dhm1d02bhrfj6l1cz1dpldz6ishb78zzvy8245zgvh7pdnhash mismatch for store item '/gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem'build of /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv failedView build log at '/var/log/guix/drvs/vf/1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv.bz2'.cannot build derivation `/gnu/store/paq8cw9f06lxw34aakk0vg1b9nx21cqf-le-certs-0.drv': 1 dependencies couldn't be builtguix pull: error: build of `/gnu/store/paq8cw9f06lxw34aakk0vg1b9nx21cqf-le-certs-0.drv' failed
I downloaded the expected file with 'guix download' from another source and tried 'guix pull' again. Then it failed on hash mismatch for letsencryptauthorityx4.pem instead.

[-- Attachment #2: Type: text/html, Size: 3438 bytes --]

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Ludovic Courtès]

Hi,

Calle Kabo <calle@kabo.nu> skribis:

> manager@guix ~$ guix pull

[...]

> building /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv...
> downloading from https://letsencrypt.org/certs/letsencryptauthorityx3.pem...
> |sha256 hash mismatch for /gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem:
>   expected hash: 0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk
>   actual hash:   1kvac1dhm1d02bhrfj6l1cz1dpldz6ishb78zzvy8245zgvh7pdn
> hash mismatch for store item '/gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem'

These 3 files are now available from https://ci.guix.gnu.org as
substitutes:

--8<---------------cut here---------------start------------->8---
$ sha1sum *.pem
af259e2e2ebd686861e3f89be6845298bed6c223  isrgrootx1.pem
36205ada14d1cded7e85294762630b6b57088198  letsencryptauthorityx3.pem
59057c31e97d8e10cc52edb389b1e87089a245aa  letsencryptauthorityx4.pem
$ for i in *.pem; do echo $(guix hash $i) $i ; done
0zhd1ps7sz4w1x52xk3v7ng6d0rcyi7y7rcrplwkmilnq5hzjv1y isrgrootx1.pem
0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk letsencryptauthorityx3.pem
003dc94c8qwj634h0dq743x7hqv9rdcfaisdksprkmi2jd107xq4 letsencryptauthorityx4.pem
--8<---------------cut here---------------end--------------->8---

and the ‘le-certs’ package itself is now available as a substitute from
ci.guix.gnu.org.

For the record, this failure stems from the combination of two issues:
(1) letsencrypt.org modified these PEM files in place, and (2) the old
copies had disappeared from ci.guix.gnu.org.  Fortunately they were still
on mirror.hydra.gnu.org, which is where I copied them frmo.

We should also update our ‘le-certs’ package definition to refer to the
new file hashes.

Ludo’.

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Tobias Geerinckx-Rice]

[-- Attachment #1: Type: text/plain, Size: 430 bytes --]

Ludo',

Ludovic Courtès wrote:
> These 3 files are now available from https://ci.guix.gnu.org as
> substitutes:

Thanks!  I tried to help Calle with this on IRC yesterday but had 
to make due with my own little build farm (which had already 
collected 2 of the 3 files) and scp…

Did you do a fancier version of this, or is there a better 
(automated?) way we could handle this in future?

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Calle Kabo]

[-- Attachment #1: Type: text/plain, Size: 350 bytes --]

I tried running guix pull again, but still didn't work
https://paste.debian.net/1081770 <https://paste.debian.net/1081770>

Here's my config.scm
https://paste.debian.net/1081771 <https://paste.debian.net/1081771>

I then connected via VPN so I got an IP in the Netherlands, and le-certs downloaded just fine! So this may be a mirroring issue?

/Calle

[-- Attachment #2: Type: text/html, Size: 865 bytes --]

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Ludovic Courtès]

Hello,

Calle Kabo <calle@kabo.nu> skribis:

> I tried running guix pull again, but still didn't work
> https://paste.debian.net/1081770

This shows that substitutes were not used:

--8<---------------cut here---------------start------------->8---
41 building /gnu/store/2bahavdikdgvznc7yn1qmnpbw4pz0jnr-letsencryptauthorityx4.pem.drv...
42 downloading from https://letsencrypt.org/certs/letsencryptauthorityx4.pem...
43 |sha256 hash mismatch for /gnu/store/rrjqsmxk40fza2gra7pr9pbsdhbcbp0g-letsencryptauthorityx4.pem:
44   expected hash: 003dc94c8qwj634h0dq743x7hqv9rdcfaisdksprkmi2jd107xq4
45   actual hash:   0giiixknr0mls2ir6qqzb42mq7x9a7vz79gbn7fjszbf87pqhpzm
--8<---------------cut here---------------end--------------->8---

That’s why you get the exact same result as before.

The reason substitutes were not used is that Guix cached the fact that
substitutes weren’t available.  They became available in the meantime
but the cached entry hasn’t expired yet.

To work around it, you could wait some more :-), or you can do:

  guix pull --substitute-urls=https://berlin.guixsd.org

berlin.guixsd.org provides the same contents as ci.guix.gnu.org.
However, that will trick Guix into building a fresh cache for that
machine.

Let us know how it goes!

Ludo’.

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Calle Kabo]

[-- Attachment #1: Type: text/plain, Size: 207 bytes --]

Ah, right, so substitutes were used on my system, just not for this particular install.
Well, hopping on the VPN and getting a Dutch IP solved it for me and I'm no longer able to reproduce the issue.

/Calle

[-- Attachment #2: Type: text/html, Size: 509 bytes --]

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Tobias Geerinckx-Rice]

[-- Attachment #1: Type: text/plain, Size: 705 bytes --]

Ludo',

Ludovic Courtès wrote:
> The reason substitutes were not used is that Guix cached the 
> fact that
> substitutes weren’t available.  They became available in the 
> meantime
> but the cached entry hasn’t expired yet.
>
> To work around it, you could wait some more :-), or you can do:
>
>   guix pull --substitute-urls=https://berlin.guixsd.org
>
> berlin.guixsd.org provides the same contents as ci.guix.gnu.org.
> However, that will trick Guix into building a fresh cache for 
> that
> machine.

I just ‘sudo rm -rf /var/guix/substitute/cache/*’ when this 
happens, and it seems to work, but I'm curious why you didn't 
recommend it here.

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]