From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bengt Richter Subject: bug#39194: help for non-root users to start using Date: Mon, 20 Jan 2020 15:07:13 -0800 Message-ID: <20200120230713.GA8973@LionPure> References: <87blqzqen8.fsf@gnu.org> Reply-To: Bengt Richter Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:59388) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1itg9M-0007vf-15 for bug-guix@gnu.org; Mon, 20 Jan 2020 18:08:05 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1itg9K-0006Wl-Ae for bug-guix@gnu.org; Mon, 20 Jan 2020 18:08:03 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:40265) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1itg9K-0006Wh-6G for bug-guix@gnu.org; Mon, 20 Jan 2020 18:08:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1itg9K-0006Nt-20 for bug-guix@gnu.org; Mon, 20 Jan 2020 18:08:02 -0500 Sender: "Debbugs-submit" Resent-Message-ID: Content-Disposition: inline In-Reply-To: <87blqzqen8.fsf@gnu.org> List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane-mx.org@gnu.org Sender: "bug-Guix" To: 39194@debbugs.gnu.org, ludo@gnu.org, matt.wette@gmail.com Hi Ludo, On +2020-01-19 23:12:43 +0100, Ludovic Courtès wrote: > Hi Matt, > > Matt Wette skribis: > > > This guix-1.0.1 on x86_64 Fedora 30. > > > > After installing as root, it's not clear from the manual how users > > should start. > > I found out "guix pull" is the right thing. > > Maybe add that to the manual? (Or add a "guix init" command.) > > “guix pull” brings you an up-to-date Guix, which is a good thing, but > you don’t _have_ to run it to get started. > > > Here is the error that I get w/o "guix pull": > > > > [mwette@localhost ~]$ guix install hello > > Backtrace: > >            8 (primitive-load "/usr/local/bin/guix") > > In guix/ui.scm: > >   1813:12  7 (run-guix-command _ . _) > > In ice-9/boot-9.scm: > >     829:9  6 (catch _ _ # ?) > >     829:9  5 (catch _ _ # ?) > > In guix/scripts/package.scm: > >    948:10  4 (_) > > In guix/status.scm: > >     768:4  3 (call-with-status-report _ _) > > In guix/scripts/package.scm: > >    956:14  2 (_) > > In guix/build/syscalls.scm: > >   1127:14  1 (call-with-file-lock/no-wait _ # ?) > > In ice-9/boot-9.scm: > >     777:6  0 (throw "open-file" "~A: ~S" ("No such file or direc?" ?) ?) > > > > ice-9/boot-9.scm:777:6: In procedure throw: > > In procedure throw: Wrong type argument in position 1: open-file > > I believe this is fixed by commit 7842ddcbc118cbc2799e22651732b7cdc06b93ee. > Did that commit cause an automatic update to the tarball found and used by the binary install script [1] ?? [1] https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh The latter defines GNU_URL="https://ftp.gnu.org/gnu/guix/" as its source of tarballs and signatures. Looking at that URL with a browser, I see --8<---------------cut here---------------start------------->8--- [ ]guix-binary-1.0.1.x86_64-linux.tar.xz 2019-05-19 16:54 60M [ ]guix-binary-1.0.1.x86_64-linux.tar.xz.sig 2019-05-19 16:54 833 --8<---------------cut here---------------end--------------->8--- and checking on the date of commit 7842dd, I get --8<---------------cut here---------------start------------->8--- commit 7842ddcbc118cbc2799e22651732b7cdc06b93ee Author: Ludovic Courtès Date: Sun Jan 19 22:52:31 2020 +0100 guix package: Create profiles/per-user/$USER upfront. Fixes . Reported by Matt Wette . * guix/scripts/package.scm (build-and-use-profile): Move 'ensure-default-profile' call to... (process-actions): ... here. --8<---------------cut here---------------end--------------->8--- So for a script user, 2019-05-19 16:54 tarball vs Sun Jan 19 22:52:31 2020 fix appears to be a problem :) I doctored the script [1] to do everything but the installing part, to make sure what tarball was being used by my system. Here is its output: --8<---------------cut here---------------start------------->8--- [05:53 ~/bs]$ ./get-guix-ver.sh ░░░ ░░░ ░░▒▒░░░░░░░░░ ░░░░░░░░░▒▒░░ ░░▒▒▒▒▒░░░░░░░ ░░░░░░░▒▒▒▒▒░ ░▒▒▒░░▒▒▒▒▒ ░░░░░░░▒▒░ ░▒▒▒▒░ ░░░░░░ ▒▒▒▒▒ ░░░░░░ ▒▒▒▒▒ ░░░░░ ░▒▒▒▒▒ ░░░░░ ▒▒▒▒▒ ░░░░░ ▒▒▒▒▒ ░░░░░ ░▒▒▒▒▒░░░░░ ▒▒▒▒▒▒░░░ ▒▒▒▒▒▒░ _____ _ _ _ _ _____ _ / ____| \ | | | | | / ____| (_) | | __| \| | | | | | | __ _ _ ___ __ | | |_ | . ' | | | | | | |_ | | | | \ \/ / | |__| | |\ | |__| | | |__| | |_| | |> < \_____|_| \_|\____/ \_____|\__,_|_/_/\_ This script is a modification of the guix-install.sh script recommended in the on-line guix manual section on binary installation [1] where the actual script is also linked [2]. It normally installs GNU Guix on your system, but was modified by commenting out the actual installation parts, retaining determination of the release for your system and checking the signature. In addition sha1 digests of the tarball and the original and modified scripts are also provided. [1] https://guix.gnu.org/manual/en/html_node/Binary-Installation.html [2] https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh This modified version does not need to be run as root. https://www.gnu.org/software/guix/ Press return to continue... [1579528426.548]: Starting installation (Mon 20 Jan 2020 05:53:46 AM PST) [1579528426.550]: [ PASS ] verification of required commands completed [1579528426.574]: [ INFO ] init system is: systemd [1579528426.576]: [ INFO ] system is x86_64-linux [1579528427.114]: [ PASS ] Release for your system: guix-binary-1.0.1.x86_64-linux [1579528427.116]: [ INFO ] Downloading Guix release archive guix-binary-1.0.1.x86_64-linux.tar.xz 100%[==================================================>] 59.66M 7.05MB/s in 9.2s guix-binary-1.0.1.x86_64-linux.tar.xz.s 100%[==================================================>] 833 --.-KB/s in 0s [1579528436.864]: [ PASS ] download completed. [1579528437.426]: [ PASS ] Signature is valid. [1579528437.427]: [ INFO ] sha1sum digest of guix-binary-1.0.1.x86_64-linux.tar.xz: 8288422fde6a6d4ee257355c21ab9447ae9736cf guix-binary-1.0.1.x86_64-linux.tar.xz [1579528437.580]: [ INFO ] Downloading Guix install script 'guix-install.sh' guix-install.sh 100%[==================================================>] 13.68K --.-KB/s in 0s [1579528438.299]: [ PASS ] download completed. [1579528438.304]: [ INFO ] sha1sum digest of guix-install.sh 4402af0b8c130b1cabf7fb5e68ec3183a02633b0 guix-install.sh [1579528438.308]: [ INFO ] sha1sum digest of /home/bokr/BS/bs20200119_2359/get-guix-ver.sh 6926ea98230514b731c4ebe9edae8c9a5e01c0a9 /home/bokr/BS/bs20200119_2359/get-guix-ver.sh [1579528438.311]: [ INFO ] This is last command in modified guix-install.sh script. [05:53 ~/bs]$ --8<---------------cut here---------------end--------------->8--- Well, I hacked in some extra stuff, but I think it would be nice to give the script a -n --dry-run option, and print the tarball dates along with a last-commit date, etc. to show automatically what I did manually above. Also, it the script [1] under git version control? Perhaps as a verbatim texi node in guix info? WDYT? BTW I think guix use via binary installs on "foreign distros" will grow to a majority. Especially if those who want to try it can pre-check with a dry run that can be run as plain user and which outputs good warnings as appropriate. I am now on PureOS on a Librem13v4, which is based on Debian apt packaging, limited IIUC to their vetted repo based on Debian upstream. So I wonder what I have done to my trust tree by running the binary install script. I hate to think. There sure are a lot of committers who I don't know from Adam ;-/ > Here’s my understanding of what happened: > > 1. You’re running guix-daemon 1.0.1, which lacks the fix for > (aka. CVE-2019-18192). > > 2. As “mwette”, you ran ‘guix pull’ and obtained a new ‘guix’, which > you then used in ‘guix install hello’ above. > > 3. That new Guix contains the new profile locking mechanism that threw > the exception we see above. That exception is because it failed to > create the lock file (“No such file or directory”), and that in > turn is because /var/guix/profiles/per-user/mwette didn’t exist > yet. > > /…/per-user/mwette didn’t exist because it was the first time you > ran ‘guix install’ as “mwette”, and because guix-daemon lacks the > fix mentioned above that would create upon first connection. > > QED ■ :-) > > Thanks for your report! > > Ludo’. > -- Regards, Bengt Richter