From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp12.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms5.migadu.com with LMTPS id sJLoOEXeYmL7VQAAbAwnHQ (envelope-from ) for ; Fri, 22 Apr 2022 18:56:38 +0200 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp12.migadu.com with LMTPS id qH3JOEXeYmKMbgEAauVa8A (envelope-from ) for ; Fri, 22 Apr 2022 18:56:37 +0200 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 3F434CCDE for ; Fri, 22 Apr 2022 18:56:37 +0200 (CEST) Received: from localhost ([::1]:55504 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1nhwaB-0005qi-K4 for larch@yhetil.org; Fri, 22 Apr 2022 12:56:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:48370) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nhwWV-0008RM-1G for help-guix@gnu.org; Fri, 22 Apr 2022 12:52:47 -0400 Received: from sender4-op-o10.zoho.com ([136.143.188.10]:17031) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nhwWS-0007Ce-KH for help-guix@gnu.org; Fri, 22 Apr 2022 12:52:46 -0400 ARC-Seal: i=1; a=rsa-sha256; t=1650646359; cv=none; d=zohomail.com; s=zohoarc; b=APfCma/GEXL1oGE0nX0kmHs4+uzPROyONrp0HQWP9L+OXvPV0jILmLI/O197DLi3ij7/6y8LBSR5KOBX20s7iY7J7XsMQjSpWhUM2dE15zVHGW7zWnkq2PeLFh00CHC8sEh6zmA35XLu63648PkLM8JP+hc8EIADg/0fId6Gv9I= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1650646359; h=Content-Type:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=6Lnb2mGOfFaCqialuqXwOWB1J8TyPk8MiCBW3i8gMm8=; b=M8LtiDIBa2OfkQf++B+M76ehV307rkY/FZiJ6GSBzzZXX81jIBQKyKRpUHIPMEPU+132R0Fnceq0kCTCL3SVda4WfjSYiO1bBl1HD3ltttl7BM8I5b6w5EPFgQOAJvjuLWxSCueqkY8MR/z6EUMNc5wzF+dfuJgZdibXmXGNzP0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=rdklein.fr; spf=pass smtp.mailfrom=edou@rdklein.fr; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1650646359; s=zoho; d=rdklein.fr; i=edou@rdklein.fr; h=References:From:From:To:To:Subject:Subject:Date:Date:In-reply-to:Message-ID:MIME-Version:Content-Type:Message-Id:Reply-To:Cc; bh=6Lnb2mGOfFaCqialuqXwOWB1J8TyPk8MiCBW3i8gMm8=; b=aBPJVnLt26khC5JqrQsJFU5B+hVKEQktmtN7fCo2FDXG7xGJS6l7AgqOq6ihLtbz 6wOmfPMxHty+UseyHtN95ue7kTXm7QfL6lON8L/9/REkSsoJHGYYnXQaT8XaIK97Q7s Bglu/TfkHbVenyuU/kedgom7NOWMxhvJyjEcCxS8= Received: from schwarzy (lfbn-idf3-1-202-150.w90-22.abo.wanadoo.fr [90.22.201.150]) by mx.zohomail.com with SMTPS id 1650646357755233.56341535355887; Fri, 22 Apr 2022 09:52:37 -0700 (PDT) References: <20220412212844.GB7246@gac.attlocal.net> <877d7tzh67.fsf@kolabnow.com> <20220413174156.GB13771@gac.attlocal.net> <87lew8echs.fsf@163.com> <20220414011701.GB3320@gac.attlocal.net> <877d7rveeu.fsf@contorta> <20220414160113.GB24691@gac.attlocal.net> <877d7rto10.fsf@dustycloud.org> <20220414162741.GB26758@gac.attlocal.net> <87r15zrvvp.fsf@dustycloud.org> <20220414230815.GB22970@gac.attlocal.net> <87pmliqgi5.fsf@rdklein.fr> <87ilrab2f7.fsf@dustycloud.org> User-agent: mu4e 1.6.10; emacs 27.2 From: Edouard Klein To: help-guix@gnu.org Subject: Re: was I hacked? Date: Fri, 22 Apr 2022 18:47:37 +0200 In-reply-to: <87ilrab2f7.fsf@dustycloud.org> Message-ID: <87r15poybi.fsf@rdklein.fr> MIME-Version: 1.0 Content-Type: text/plain X-ZohoMailClient: External Received-SPF: pass client-ip=136.143.188.10; envelope-from=edou@rdklein.fr; helo=sender4-op-o10.zoho.com X-Spam_score_int: -16 X-Spam_score: -1.7 X-Spam_bar: - X-Spam_report: (-1.7 / 5.0 requ) BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: help-guix@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+larch=yhetil.org@gnu.org Sender: "Help-Guix" X-Migadu-Flow: FLOW_IN X-Migadu-To: larch@yhetil.org X-Migadu-Country: US ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1650646597; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=6Lnb2mGOfFaCqialuqXwOWB1J8TyPk8MiCBW3i8gMm8=; b=l5cPhCww9e+75U+9A9LGzmdbk7snbscVtm0tK8+QxXWgmfjOvvIO0SiwJ194t64/IpsrFn f/ajCv+SE9DxvtJ5M+OD/ZtmtZlbtR7u3sUMkqMuihkcwM5YArHXYnY3V2RZdqi5qz5TY6 UZYKPQSlpx1fLlWlRKdEckcMit65P+XyqxMchN5D3mNehJ31l5rEAAjp/PGn62CuXOWKrD GeMMbXrs2/Wfb4UJ6Ydd17/MS7J1hTzclAmm91lUUx8WTwobchy6///LQUZ0iUetTFFJ9r 1GBKbgOACiaYBMIcxR0Kxby9eqxoX8hU6MU285PedWEHJ3idCvu46hAnI6zHiQ== ARC-Seal: i=2; s=key1; d=yhetil.org; t=1650646597; a=rsa-sha256; cv=pass; b=dXPgrjezuFI8CM2fKVV89xi3318GTvlaGI5vdDZ7QEuEshLj3/fBeviX30p5I+8dGKxKA2 lCVxVxSn+jIuoG5RVt+6IV03rg+wKgMQ7dQ0NFfBpuHpBb0OOtewEgocq1SYFvuNCyvizh dEJrXFo7t904hHpum0UQS2JLLm5m8EmPru44SQDdCX3QkWkQg4o7xyJiYbfvdK98HnsZtk azvamN7ha7O5/ELdpIEQi6Rw/75vqm6sCh0xPCqiiflExcKnWZq4Iq4bPP3FBMwSmf3fQw XgbcBTfvXYaX03Kn1uLRoiaN+NunzN3V5i0iUZ6Y2JFQp91A8MiERv020DqEmQ== ARC-Authentication-Results: i=2; aspmx1.migadu.com; dkim=none ("invalid DKIM record") header.d=rdklein.fr header.s=zoho header.b=aBPJVnLt; arc=pass ("zohomail.com:s=zohoarc:i=1"); dmarc=none; spf=pass (aspmx1.migadu.com: domain of "help-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="help-guix-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -3.81 Authentication-Results: aspmx1.migadu.com; dkim=none ("invalid DKIM record") header.d=rdklein.fr header.s=zoho header.b=aBPJVnLt; arc=pass ("zohomail.com:s=zohoarc:i=1"); dmarc=none; spf=pass (aspmx1.migadu.com: domain of "help-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="help-guix-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: 3F434CCDE X-Spam-Score: -3.81 X-Migadu-Scanner: scn1.migadu.com X-TUID: /dV95Ep5tlIt Hi, I diffed the git log of both https://git.sr.ht/~whereiseveryone/pjmkglp and guix official repo and could not find any difference (apart from the most recent commits on the official repo of course). I also confirmed, as had already been said, that commit 950f3e4f98 is indeed a descendant of 42679e3f81, so the error message makes no sense :/ I have absolutely no idea what went wrong. I'm still very much interested in the answer, but I've reached the edge of my ability to investigate. Let's hope that somebody can find out what went wrong. Cheers, Edouard. Christine Lemmer-Webber writes: > Well good news, jgart pushed them elsewhere in the thread: > > jgart writes: > >> Here are the repos of interest: >> >> https://git.sr.ht/~whereiseveryone/pjmkglp >> >> https://git.sr.ht/~whereiseveryone/authentification-channels >> >> wdyt? > > > Edouard Klein writes: > >> Hi, >> >> Sorry about the noise, but I'm curious about this as well, and I think >> if this is indeed an attack that it would be brilliant to see that guix >> protected against it. I would like to document it. >> >> @jgart I can open a git repo for you and lend a hand if you need help >> pushing the strange branch somewhere. >> >> Cheers, >> >> Edouard >> >> Jack Hill writes: >> >>> On Thu, 14 Apr 2022, jgart wrote: >>> >>>> What I not sure of is what path on my system to find the suspicious >>>> branch/git repo pulled down by `git/guix pull` so I can push it somewhere. >>>> >>>> In other words, where does `guix pull` clone the git repo to? >>> >>> ~/.cache/guix/checkouts >>> >>> ~/.cache/guix/authentication may be interesting as well. >>> >>> (I bet (hope?) it's actually XDG_CACHE_DIR/guix but you get the idea) >>> >>> Sorry I don't have insight in to what went wrong. >>> >>> Take care, >>> Jack