Re: [PATCH 1/2] gnu: fuse: Update to 2.9.4.

[Leo Famulari <leo@famulari.name>]

On Tue, Dec 29, 2015 at 10:34:53PM -0500, Mark H Weaver wrote:
> Mark H Weaver <mhw@netris.org> writes:
> 
> > Leo Famulari <leo@famulari.name> writes:
> >
> >> * gnu/packages/patches/fuse-CVE-2015-3202.patch: Delete file.
> >> * gnu-system.am (dist_patch_DATA): Remove it.
> >> * gnu/packages/linux.scm (fuse): Update to 2.9.4.
> >>   [source]: Remove patch.
> >
> > This patch broke the build on all platforms, because the source URI
> > returns 404 "Not Found".  See:
> >
> >   http://hydra.gnu.org/build/905375/nixlog/1/tail-reload
> >
> > Starting download of /gnu/store/1yv745ixmy5r5mf5pnlppd31pz0qnqab-fuse-2.9.4.tar.gz
> > From https://github.com/libfuse/libfuse/releases/download/2_9_4/fuse-2.9.4.tar.gz...
> > ERROR: download failed "https://github.com/libfuse/libfuse/releases/download/2_9_4/fuse-2.9.4.tar.gz" 404 "Not Found"
> > failed to download "/gnu/store/1yv745ixmy5r5mf5pnlppd31pz0qnqab-fuse-2.9.4.tar.gz" from "https://github.com/libfuse/libfuse/releases/download/2_9_4/fuse-2.9.4.tar.gz"
> >
> > Can you look into it?

My apologies!

> 
> I went ahead and fixed this myself, after realizing that this problem
> would cause attempts to build systems that use %base-services to fail,
> which I expect is almost all of them.  The reason is that %base-services
> includes 'fuse' here:
> 
>   ;; The LVM2 rules are needed as soon as LVM2 or the device-mapper is
>   ;; used, so enable them by default.  The FUSE and ALSA rules are
>   ;; less critical, but handy.
>   (udev-service #:rules (list lvm2 fuse alsa-utils crda))

Thank you for taking care of it.

> 
> Mistakes in source URIs like this are likely to go undetected for those
> who use "guix download" to download the source, which is why I never do
> that.  I always use "wget" to download the source, and then "guix hash"
> to compute the hash (after checking the signature), and finally "guix
> build -K" to test the updated 'source' field by downloading the source a
> second time before building the package.

I usually just put the URL in the package definition and then get the
hash from the failed build, but this one was so special that I must have
used `guix download` at some point.

Thanks for explaining this pitfall. I'll keep it in mind in the future.

> 
>      Regards,
>        Mark