nss-certs: hash mismatch on berlin

nss-certs: hash mismatch on berlin

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 1349 bytes --]

Hi Ludo,
Hi Guix,

while trying to build a new installer-image, I encountered:

 nss-certs-3.44.1  150KiB                                                                                  4.0MiB/s 00:00 [##################] 100.0%

sha256 hash mismatch for /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1:
  expected hash: 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
  actual hash:   1awgljvsvc141350xyjjnb15hk66qpcpzwz0hrly11yfbw6wn7cv
substitution of /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 failed
killing process 29347
guix system: error: some substitutes for the outputs of derivation `/gnu/store/br6w1qmw2b98c6fa45gy0ljqdzjw70vr-nss-certs-3.44.1.drv' failed (usually happens due to networking issues); try `--fallback' to build derivation from source 


I'm seeing this around for a while now. Sometimes it works, sometimes
not.

Any ideas on how to fix this?

Is this related to the closed:

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=33603

Is this related to the docker-bug we had lately:

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=36215

Also, there was one sha256-mismatch for ruby-sass:

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=35437

Is this a package-specific problem or a general configuration problem
on Berlin (or one of its slaves)?

Björn

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: nss-certs: hash mismatch on berlin

[Ricardo Wurmus]

Hi Björn,

> Is this a package-specific problem or a general configuration problem
> on Berlin (or one of its slaves)?

I don’t see how a hash mismatch could be a configuration problem on
Berlin or one of its build nodes.  Do you have something specific in
mind?

--
Ricardo

Re: nss-certs: hash mismatch on berlin

[Ludovic Courtès]

Hello,

Björn Höfling <bjoern.hoefling@bjoernhoefling.de> skribis:

> Hi Ludo,
> Hi Guix,
>
> while trying to build a new installer-image, I encountered:
>
>  nss-certs-3.44.1  150KiB                                                                                  4.0MiB/s 00:00 [##################] 100.0%
>
> sha256 hash mismatch for /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1:
>   expected hash: 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
>   actual hash:   1awgljvsvc141350xyjjnb15hk66qpcpzwz0hrly11yfbw6wn7cv
> substitution of /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 failed

Like Ricardo, I get the correct hash everywhere:

--8<---------------cut here---------------start------------->8---
$ wget -qO - http://berlin.guix.gnu.org/32hy1jqkam201l7c4wg3bhxz4x5l5jy0.narinfo | grep Hash
NarHash: sha256:0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
$ wget -qO - http://berlin.guix.gnu.org/nar/lzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 | lzip -d | guix hash -
0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
$ wget -qO - http://berlin.guix.gnu.org/nar/gzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 | gunzip | guix hash -
0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
$ wget -qO - http://ci.guix.gnu.org/nar/lzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 | lzip -d | guix hash -
0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
$ wget -qO - http://ci.guix.gnu.org/nar/gzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 | gunzip | guix hash -
0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
--8<---------------cut here---------------end--------------->8---

Could you run these commands locally and see what you get?

Could it be lack of disk space or a transient networking issue on your side?

Thanks,
Ludo’.

Re: nss-certs: hash mismatch on berlin

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 4308 bytes --]

Hi Ludo,

On Thu, 25 Jul 2019 19:10:11 +0200
Ludovic Courtès <ludo@gnu.org> wrote:

> Hello,
> 
> Björn Höfling <bjoern.hoefling@bjoernhoefling.de> skribis:
> 
> > Hi Ludo,
> > Hi Guix,
> >
> > while trying to build a new installer-image, I encountered:
> >
> >  nss-certs-3.44.1
> > 150KiB
> > 4.0MiB/s 00:00 [##################] 100.0%
> >
> > sha256 hash mismatch
> > for /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1:
> > expected hash: 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
> > actual hash:   1awgljvsvc141350xyjjnb15hk66qpcpzwz0hrly11yfbw6wn7cv
> > substitution
> > of /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1
> > failed  
> 
> Like Ricardo, I get the correct hash everywhere:
> 
> --8<---------------cut here---------------start------------->8---
> $ wget -qO -
> http://berlin.guix.gnu.org/32hy1jqkam201l7c4wg3bhxz4x5l5jy0.narinfo |
> grep Hash NarHash:
> sha256:0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad $ wget
> -qO -
> http://berlin.guix.gnu.org/nar/lzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1
> | lzip -d | guix hash -
> 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad $ wget -qO -
> http://berlin.guix.gnu.org/nar/gzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1
> | gunzip | guix hash -
> 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad $ wget -qO -
> http://ci.guix.gnu.org/nar/lzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1
> | lzip -d | guix hash -
> 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad $ wget -qO -
> http://ci.guix.gnu.org/nar/gzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1
> | gunzip | guix hash -
> 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
> --8<---------------cut here---------------end--------------->8---
> 
> Could you run these commands locally and see what you get?
> 
> Could it be lack of disk space or a transient networking issue on
> your side?
> 
> Thanks,
> Ludo’.

This is strange and I have no clue what's going wrong here: All your
commands above work as expected.

Yes, I'm running out of disk space, but everything else works and the
nss-package isn't the biggest one. Currently 8 GiB left.

I built it locally, that worked. Now deleting it:

$ guix gc -D /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1

Then trying to fetch it:

~/guix/wt/nonfree [env]$ ./pre-inst-env  guix build nss-certs
0.2 MB will be downloaded:
   /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1
substituting /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1...
downloading from https://ci.guix.gnu.org/nar/gzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1...
 nss-certs-3.44.1  150KiB                                                                                  1.0MiB/s 00:00 [##################] 100.0%

sha256 hash mismatch for /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1:
  expected hash: 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
  actual hash:   1awgljvsvc141350xyjjnb15hk66qpcpzwz0hrly11yfbw6wn7cv
substitution of /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 failed
guix build: error: some substitutes for the outputs of derivation `/gnu/store/br6w1qmw2b98c6fa45gy0ljqdzjw70vr-nss-certs-3.44.1.drv' failed (usually happens due to networking issues); try `--fallback' to build derivation from source 

This is on dd9c137b2c759f906d57b14fccff091994f274e8

Manually downloading seams to find the right hash:

$ wget -qO - https://ci.guix.gnu.org/nar/gzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 |  gunzip | guix hash -
0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad

$ ls /gnu/store/*nss-certs-3.44.1* -d
/gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1       /gnu/store/br6w1qmw2b98c6fa45gy0ljqdzjw70vr-nss-certs-3.44.1.drv
/gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1.lock  /gnu/store/fpv0xrrr47g879agkmchzzamw1p46i46-nss-certs-3.44.1-guile-builder

I blamed that something about locales is wrong on berlin. Could it be
the case that on my side something with locales is wrong? In the build
daemon? I'm on Ubunutu+Guix, that might cause also some trouble? How
can I verify/check my locale-configs?

Thanks,

Björn

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: nss-certs: hash mismatch on berlin

[Ludovic Courtès]

Hello,

Björn Höfling <bjoern.hoefling@bjoernhoefling.de> skribis:

> ~/guix/wt/nonfree [env]$ ./pre-inst-env  guix build nss-certs
> 0.2 MB will be downloaded:
>    /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1
> substituting /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1...
> downloading from https://ci.guix.gnu.org/nar/gzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1...
>  nss-certs-3.44.1  150KiB                                                                                  1.0MiB/s 00:00 [##################] 100.0%
>
> sha256 hash mismatch for /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1:
>   expected hash: 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
>   actual hash:   1awgljvsvc141350xyjjnb15hk66qpcpzwz0hrly11yfbw6wn7cv
> substitution of /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 failed
> guix build: error: some substitutes for the outputs of derivation `/gnu/store/br6w1qmw2b98c6fa45gy0ljqdzjw70vr-nss-certs-3.44.1.drv' failed (usually happens due to networking issues); try `--fallback' to build derivation from source 
>
> This is on dd9c137b2c759f906d57b14fccff091994f274e8
>
> Manually downloading seams to find the right hash:
>
> $ wget -qO - https://ci.guix.gnu.org/nar/gzip/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1 |  gunzip | guix hash -
> 0vbkb5mcwzbz4lm1c1319pail61785sd3lj6526vl5hdnp1rxyad
>
> $ ls /gnu/store/*nss-certs-3.44.1* -d
> /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1       /gnu/store/br6w1qmw2b98c6fa45gy0ljqdzjw70vr-nss-certs-3.44.1.drv
> /gnu/store/32hy1jqkam201l7c4wg3bhxz4x5l5jy0-nss-certs-3.44.1.lock  /gnu/store/fpv0xrrr47g879agkmchzzamw1p46i46-nss-certs-3.44.1-guile-builder
>
> I blamed that something about locales is wrong on berlin. Could it be
> the case that on my side something with locales is wrong? In the build
> daemon? I'm on Ubunutu+Guix, that might cause also some trouble? How
> can I verify/check my locale-configs?

If your guix-daemon is not running under a UTF-8 locale, then nss-certs
may end up being unpacked with incorrect file names (though I thought
that was supposed to be treated as an error, oh well.)

You can find the PID of guix-daemon, and then do something like:

  cat /proc/PID/environ | xargs -0 echo

and look at the value of GUIX_LOCPATH and LC_ALL there.  Both should be
valid.

Thanks,
Ludo’.