From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2.migadu.com ([2001:41d0:403:58f0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms13.migadu.com with LMTPS id SOV7CxhYLmeaXgEAe85BDQ:P1 (envelope-from ) for ; Fri, 08 Nov 2024 18:27:36 +0000 Received: from aspmx1.migadu.com ([2001:41d0:403:58f0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2.migadu.com with LMTPS id SOV7CxhYLmeaXgEAe85BDQ (envelope-from ) for ; Fri, 08 Nov 2024 19:27:36 +0100 X-Envelope-To: larch@yhetil.org Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=incana.org header.s=key1 header.b=qkkaxKb3; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=pass (policy=quarantine) header.from=incana.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1731090456; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=Ye08ojyNYFtTSmRRYC9s/lnuN1mfmoRaS1l7mjO2Br4=; b=P1S0TBGLSPW2yEMUrK7nvrmSlvL5CvenPvYLtAzS27vWkbqFHVJGGmhz1EjNcBtOsbg93w 2mEuAQOGqfAUZNndrLXDf0MmYMBJEx3o7ghDBz6It4r0ltzdc8dZromyGjA2LsCmvsFtLh HvfmRbp8tOc7eqWSC36Pjh6DvdMlC0zInBZK1Q4VzbvOrnErpd5tkl5TGqjtaK2L22sM8W obLION45f8gXQ1BYYw3rto/YAIytCKHoDLBHajPAHgBBNrUaMzPg09G9bjsBPAGIzm22YQ HqGLBGhNCllaCvasQOeutW2bs14tx9B3zt7iSdi5KbqTm8LH/YKqhWGrWicveA== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=incana.org header.s=key1 header.b=qkkaxKb3; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=pass (policy=quarantine) header.from=incana.org ARC-Seal: i=1; s=key1; d=yhetil.org; t=1731090456; a=rsa-sha256; cv=none; b=kLMu13HI3RR0nlzx/QsHplM7BoSc7ySJDRCqxO3jzKYJ+bFMIkLvD8BwmqKNRkfYIbrrRk b/sfT5ffzthkEBLfqzunVfWJc/xO5zMW3U4VS59+qN1luiAtI2O3yK6UMABQ41nxsXuMfI Omoba9aya6Wo4RV+Bz8y6N9GBrpRCHIP4V2uK1Wh1N4DKsRXj50c9XP2f9YO/kI5q1+f/k CJcVC8vuYSOuJ2WJ6ppgQTIAPNcENFx7MFKHsc+6MPT968ypb4x/PRe1NFX2oMZPcVRjdK /UAeqc8N4QMfNHbaIl8EYaeKCEJoZ/OJwn3eV6H52AH0AP1nyqOEXvKaH2y1Kg== Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 66248835C2 for ; Fri, 08 Nov 2024 19:27:34 +0100 (CET) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1t9Th9-0007IT-Ob; Fri, 08 Nov 2024 13:26:55 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1t9Th8-0007IL-Rk for guix-devel@gnu.org; Fri, 08 Nov 2024 13:26:54 -0500 Received: from out-170.mta1.migadu.com ([95.215.58.170]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1t9Th5-000532-54 for guix-devel@gnu.org; Fri, 08 Nov 2024 13:26:54 -0500 Date: Fri, 08 Nov 2024 13:26:24 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=incana.org; s=key1; t=1731090400; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=Ye08ojyNYFtTSmRRYC9s/lnuN1mfmoRaS1l7mjO2Br4=; b=qkkaxKb3T7QTCmD0gCuIV5rcPajlIWHzQKjFovR/fQkRyrFscv1CrnFdQL40e8un7BChpO xlPwQ8Q/E4qxwBotP3jkAL59rhLmxqs0eLSvXSvJTa5RBWBZmQTDXzBFUGVUmVH+HXXrLm YWIzxvb83ED+zfoeXkX5crh8RWkyozdQ+7isTfzrCwk5fHgG/C+sOldKmO6xkUJaXanPIW KIqkwqGGHj/smuGc3hhLqR91VUIIVnSTPbK6dMTOnKIB//u948DZ9zUsi9lgRvuWPnvMZP xLdb3xIxm7LDwkgFeEp07g0WwbVToaMd1/GaUyZaLNUflyZoMjlT7EGlOo143w== X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Juliana Sims Subject: Magic Wormhole Package Weirdness/Potential Security Issues? To: guix-devel@gnu.org Message-Id: <0W9NMS.7ID0I9IORJ19@incana.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Received-SPF: pass client-ip=95.215.58.170; envelope-from=juli@incana.org; helo=out-170.mta1.migadu.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: guix-devel-bounces+larch=yhetil.org@gnu.org X-Migadu-Country: US X-Migadu-Flow: FLOW_IN X-Migadu-Scanner: mx11.migadu.com X-Migadu-Spam-Score: 3.07 X-Spam-Score: 3.07 X-Migadu-Queue-Id: 66248835C2 X-TUID: VURp/2tIeSaU Hey folks, I tried to update magic-wormhole today and things went super smoothly. All I had to do was change the version number. I didn't even have to change the source hash. If that strikes you as odd, good! It should! To cover all my bases, I pk'd the hash produced by `pypi-uri` and used `guix download` to try to fetch the same file and check its hash, only to find that `guix download` couldn't find anything at that URL or its fallbacks. To test if things were being exceptionally weird, I switched to pulling and building from git, and the build failed, expectedly, probably because one of the dependencies (magic-wormhole-transit-relay) was not the right version, which was what I had initially expected to happen. Does anyone know what might be going on here? Given the intended secure nature of this program, I'm concerned there may be something malicious happening somewhere along the way. I would love an explanation that quiets that concern. You can look at the current magic-wormhole package source and play around with it yourself to see what I'm talking about. Best, Juli PS I was trying to update all three packages in magic-wormhole.scm, but the transit relay in particular requires later versions of twisted and autobahn than the other two, which is minorly annoying. I know twisted can't be updated without rebuilding a bunch of stuff, so I don't plan to pursue this further for the time being.