On Sun, Oct 28, 2018 at 12:23:33PM +0100, Marco van Hulten wrote: > substitution of /gnu/store/a77ap0vw0fnsz138paby8w55rlcd58zi-calcurse-4.3.0 failed > building /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv... > downloading from http://calcurse.org/files/calcurse-4.3.0.tar.gz... > sha256 hash mismatch for /gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz: > expected hash: 16jzg0nasnxdlz23i121x41pq5kbxmjzk52c5d863rg117fc7v1i > actual hash: 11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2 > build of /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv failed > View build log at '/var/log/guix/drvs/ya/1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv.bz2'. > \guix package: error: build failed: build of `/gnu/store/r44sbjgn7gxwl3nxvlnq6946zc05xq0f-profile.drv' failed Fixed by commit a2717e698619fed3204db978f954a1195e1d2b4b, which makes Guix download the source code over HTTPS, since is no longer available over HTTP. Here is how I debugged it: First, I tried downloading the source code, avoiding substitutes because I still have the source code on my mirror: ------ $ guix build --source calcurse --no-substitutes The following derivation will be built: /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv building /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv... Starting download of /gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz From http://calcurse.org/files/calcurse-4.3.0.tar.gz... following redirection to `https://calcurse.org'... downloading from http://calcurse.org/files/calcurse-4.3.0.tar.gz... calcurse-4.3.0.tar.gz 6KiB 7.9MiB/s 00:00 [##################] 100.0% sha256 hash mismatch for /gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz: expected hash: 16jzg0nasnxdlz23i121x41pq5kbxmjzk52c5d863rg117fc7v1i actual hash: 11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2 hash mismatch for store item '/gnu/store/873m2xbqxndbhcdfrngpsj7cwflm48d0-calcurse-4.3.0.tar.gz' build of /gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv failed View build log at '/var/log/guix/drvs/ya/1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv.bz2'. guix build: error: build failed: build of `/gnu/store/ya1v2nv0mq8dzkcik64inlyxxk3skz3h-calcurse-4.3.0.tar.gz.drv' failed ------ Then, I downloaded the file in question and examined it: ------ $ guix download http://calcurse.org/files/calcurse-4.3.0.tar.gz Starting download of /tmp/guix-file.nEHs4A From http://calcurse.org/files/calcurse-4.3.0.tar.gz... following redirection to `https://calcurse.org'... ….3.0.tar.gz 6KiB 11.2MiB/s 00:00 [##################] 100.0% /gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz 11q0r4dbi8vca22x3q1ad07nr1gs4y17cgnplbjzmmz9r9x0h8m2 $ file /gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz /gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz: HTML document, ASCII text $ head --lines 10 /gnu/store/fr962qdmzziwjwngdm8a70pdkaai72mp-calcurse-4.3.0.tar.gz calcurse.org ------ So, we see that we are actually getting an HTML file (their homepage), rather than a tarball. Looking back to the original error message, we can see some suspicious redirections, from HTTP to HTTPS and then back to HTTP. This was my first clue that we were not going to download what we expected, because its rare to configure a webserver to downgrade from HTTPS to HTTP in 2018. From there, I made an educated guess that had enabled HSTS, and that we simply needed to adjust our download URL. [0] https://www.gnu.org/software/guix/manual/en/html_node/Building-from-Git.html