From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id eDpYBDUmvWEXSwEAgWs5BA (envelope-from ) for ; Sat, 18 Dec 2021 01:07:17 +0100 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id AMWGOzQmvWFCbgAAbx9fmQ (envelope-from ) for ; Sat, 18 Dec 2021 00:07:16 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id C702332CFA for ; Sat, 18 Dec 2021 01:07:16 +0100 (CET) Received: from localhost ([::1]:44296 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1myNFr-0003FD-Ue for larch@yhetil.org; Fri, 17 Dec 2021 19:07:15 -0500 Received: from eggs.gnu.org ([209.51.188.92]:57356) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1myNFg-0003Ep-Rb for bug-guix@gnu.org; Fri, 17 Dec 2021 19:07:05 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:57570) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1myNFe-0003hq-NN for bug-guix@gnu.org; Fri, 17 Dec 2021 19:07:04 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1myNFe-0005Os-Cm for bug-guix@gnu.org; Fri, 17 Dec 2021 19:07:02 -0500 X-Loop: help-debbugs@gnu.org Subject: bug#52591: downloading from software archives as default even if version is wrong Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Sat, 18 Dec 2021 00:07:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 52591 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: Andy Tai Received: via spool by 52591-submit@debbugs.gnu.org id=B52591.163978601920749 (code B ref 52591); Sat, 18 Dec 2021 00:07:02 +0000 Received: (at 52591) by debbugs.gnu.org; 18 Dec 2021 00:06:59 +0000 Received: from localhost ([127.0.0.1]:40883 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1myNFa-0005Ob-Rv for submit@debbugs.gnu.org; Fri, 17 Dec 2021 19:06:59 -0500 Received: from wout4-smtp.messagingengine.com ([64.147.123.20]:60247) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1myNFY-0005OM-N7 for 52591@debbugs.gnu.org; Fri, 17 Dec 2021 19:06:57 -0500 Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.west.internal (Postfix) with ESMTP id 7AC303200E1A; Fri, 17 Dec 2021 19:06:49 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute3.internal (MEProxy); Fri, 17 Dec 2021 19:06:49 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=mesmtp; bh=MPZGvoAJO7dqhMxPHL7+AZ73 SseFtmSbTigc3IFftSI=; b=My/sWmIWiCVEbcyOXnAPUapXvxUoDhqXCDPhhDXE uYipeXGCin+1U3eK48hUQeHqkhNytSGngIHNYJWB44AILXZ9V81ZEGjub4y5uCUD Q/wM+5dWMFnhYOrDaVLD4GcLtTGPqCXDJMvY0ks1Yx0tk7DAyp0aS1BTa+A52GJB Z74= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=MPZGvo AJO7dqhMxPHL7+AZ73SseFtmSbTigc3IFftSI=; b=d2mGYkkwdlaEk6kcECJagi mbbJUc4LKfsAmOXXIiCRg0CZxqCxz4NFxGqFAuEsXus7OaCpx1GgUwTL2QqpiCNA s1VRXssz4/uZW3sOzwWndc9Z5ClhaSgbqF7LkR7FJo2MiVGiJzoWDkiplhlpB/u2 dlqJmNwCj4EZyJOvyg23h2DJlhFEeqg7LDIVskdT82k4lxyfkWNzfpiE9hevY1/b SadHL4vVntzeiwaiMY4jQ4m9MfsucTUZsVBnYFjMc/VOYsqXl2Trt7NmhBTRugZ4 0XwA4FDBWPhhg00ivwb2HdAVtUiH8OPSDkwc/AZTrKDW9p9KTNNJCDXMiCdXdVSQ == X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvuddrleejgddutdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepfffhvffukfhfgggtuggjsehttdertd dttddvnecuhfhrohhmpefnvghoucfhrghmuhhlrghrihcuoehlvghosehfrghmuhhlrghr ihdrnhgrmhgvqeenucggtffrrghtthgvrhhnpedvvddugefffeeitddthfefvdeuhffgke eikeegkeevteeghfeftefggeeuudffieenucffohhmrghinhepghhnuhdrohhrghenucev lhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehlvghosehfrg hmuhhlrghrihdrnhgrmhgv X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 17 Dec 2021 19:06:48 -0500 (EST) Date: Fri, 17 Dec 2021 19:06:46 -0500 From: Leo Famulari Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: 52591@debbugs.gnu.org Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" X-Migadu-Flow: FLOW_IN X-Migadu-Country: US ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1639786036; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:resent-cc:resent-from:resent-sender: resent-message-id:in-reply-to:in-reply-to:references:references: list-id:list-help:list-unsubscribe:list-subscribe:list-post: dkim-signature; bh=MPZGvoAJO7dqhMxPHL7+AZ73SseFtmSbTigc3IFftSI=; b=EfmDoisVrucWZhDMPurM2xakb7o6KVf2ABvnKkCMtnSM+Yqxs+K1u31KskCc9bychyKEPX lod6TDdyZO1ntx3yP41TFL0bZ5U8pRZ57nSVzjj4rEfVcVsvjHJ5CsAK94xBkL3A5HS5/X vCSuUUHfKc4KRufRsEYSyMypP4Jp2c0Ph9p2CE4a1xjunC7QSNTcW4mYNHpQi+dWBPXrKS vIC6YH1Z38/wJ7mpS4Nb7K6TBKkPgcDOCUeNy0NgzTLhKLOZt6ysXMKVdqBWr8k9icyk5x i/QBvnd21GXjB22Q45JHlo/2OTKcBpYaoit8E9ZW0pnr/EabFOD47CgK35GqbQ== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1639786036; a=rsa-sha256; cv=none; b=bBg6AUcGfO3UFWo1x/Ju2l32wf0ZLf5500urpTqJAWdD+/0/6xFc3fMbk9wPA8cRGUxI2t wGxfioVrTbM1aDcivix5KdA2lCGvx6gaEMwFeobe4Utx9dqdF/K9MOXRF60nxsD9il167B 5PbYJfteEiJek4sNncPov9QZjAbFDoohcC1wMbPvTmaozMUEj9AFyAqd1pIQnhwXR0PE2d GRXmzDMgFqdC3c+1H7roiDimN66gcxMkX1Bp8pHJtfiu6LFTTGn0fWryN3w+sI5sJ9JQsK Xq3I/rf+s7pOqaOUx7M/yN5VAGb9zKJOqhzKkqmEgCxasb6blmi74ocxfpjngA== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=famulari.name header.s=mesmtp header.b="My/sWmIW"; dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm1 header.b=d2mGYkkw; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "bug-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="bug-guix-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -3.10 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=famulari.name header.s=mesmtp header.b="My/sWmIW"; dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm1 header.b=d2mGYkkw; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "bug-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="bug-guix-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: C702332CFA X-Spam-Score: -3.10 X-Migadu-Scanner: scn0.migadu.com X-TUID: RzCclE8wGQuX On Fri, Dec 17, 2021 at 03:40:45PM -0800, Andy Tai wrote: > as seen above, somehow the old version was downloaded from a cached > copy at softwareheritage archives, and it proceeds to build. This > should not proceed but fail for wrong checksum. This can happen with the Nix content-addressed archive fallback that we use, too. Basically, when the normal URLs fail, Guix queries these content-addressed archives by content. That is, by their hash. The version number is considered to be metadata, not content, and so the download "succeeds". Since the source origins are named by their hash, this is the correct behaviour, although there is some room for error, as you've found. Do you have any ideas about how to improve things? We taught Guix to respect the GUIX_DOWNLOAD_FALLBACK_TEST [0] environment variable, which controls how Guix uses these fallback archives. I recommend setting it to "none" if you are doing package development in order to avoid this pitfall. Otherwise, these archives are helpful for using Guix, since sources do disappear upstream, URLs change, etc, and we'd like for old versions of Guix to be usable. [0] https://git.savannah.gnu.org/cgit/guix.git/commit/?id=c4a7aa82e25503133a1bd33148d17968c899a5f5 https://git.savannah.gnu.org/cgit/guix.git/commit/?id=bd61d62182bfda4a695757ec66810b28e8e1a6d0