Re: git-fetch without a hash

["Ludovic Courtès" <ludo@gnu.org>]

Hi,

Ludovic Courtès <ludo@gnu.org> skribis:

> scheme@(guile-user)> ,lower (origin
> 			      (method url-fetch)
> 			      (uri "mirror://gnu/hello/hello-2.12.1.tar.gz")
> 			      (sha256 #f))
> $6 = #<derivation /gnu/store/lz34lhyxhq5wxj87fnd465hmwbhv17bn-hello-2.12.1.tar.gz.drv => /gnu/store/xfc7gsn10j09bi89ldbpfbppfkcldfy9-hello-2.12.1.tar.gz 7f3ff487c000>
> scheme@(guile-user)> (derivation-outputs $6)
> $7 = (("out" . #<<derivation-output> path: "/gnu/store/xfc7gsn10j09bi89ldbpfbppfkcldfy9-hello-2.12.1.tar.gz" hash-algo: sha256 hash: #f recursive?: #f>))
> scheme@(guile-user)> (fixed-output-derivation? $6)
> $8 = #f
>
> As it turns out, guix-daemon turns off the chroot for all built-in
> builders, fixed-output or not; quoth ‘build.cc’:
>
>     /* Note: built-in builders are *not* running in a chroot environment so
>        that we can easily implement them in Guile without having it as a
>        derivation input (they are running under a separate build user,
>        though).  */
>     useChroot = settings.useChroot && !isBuiltin(drv);
>
> I was actually surprised to see this, this wasn’t really intended.  The
> good news is that this is safe AFAICS: there’s only one built-in builder
> to date, and that’s “download”.

After investigating, I found that ‘guix perform-download’ already has a
check in place:

      (unless (and algo hash)
        (leave (G_ "~a is not a fixed-output derivation~%")
               (derivation-file-name drv)))

The check wasn’t working because ‘hash’ was #vu8() instead of #f.  This
is fixed in 5d24e57a611b43ff68700379338b899f62d198cc.

Once we update the ‘guix’ package, the daemon will no longer accept
‘url-fetch’ downloads with hash = #f.

Thanks again for reporting this oddity!

Ludo’.