bug#33368: "guix archive" fails because of guix-authenticate

bug#33368: "guix archive" fails because of guix-authenticate

[Konrad Hinsen]

Dear Guix maintainers,

With guix current as of today (commit
d5401375099f6e4562b849121265bb1c3e85874f), I cannot produce nar archives
because of a failure of guix-authenticate.

Demonstration:

  $ guix archive --export git > git.nar
  guix archive: error: build failed: program `guix-authenticate' failed with exit code 1

Note: I did run "guix archive –generate-key" earlier on that machine,
and I do have the public/private keys under /etc/guix.

Cheers,
  Konrad

bug#33368: "guix archive" fails because of guix-authenticate

[Ludovic Courtès]

Hi Konrad!

Konrad Hinsen <konrad.hinsen@fastmail.net> skribis:

> With guix current as of today (commit
> d5401375099f6e4562b849121265bb1c3e85874f), I cannot produce nar archives
> because of a failure of guix-authenticate.
>
> Demonstration:
>
>   $ guix archive --export git > git.nar
>   guix archive: error: build failed: program `guix-authenticate' failed with exit code 1

Could you strace the daemon and then re-run the command?

  sudo strace -p $(pidof guix-daemon) -f -o daemon.log -s 234
  guix archive --export sed > /dev/null

I tested and it works for me, so we’ll have to see what’s going wrong
behind the scenes.

Thanks,
Ludo’.

bug#33368: "guix archive" fails because of guix-authenticate

[Ludovic Courtès]

Note: If you post the strace output, make sure to remove your public key
from the log.

bug#33368: "guix archive" fails because of guix-authenticate

[Ricardo Wurmus]

Hi Konrad,

> With guix current as of today (commit
> d5401375099f6e4562b849121265bb1c3e85874f), I cannot produce nar archives
> because of a failure of guix-authenticate.
>
> Demonstration:
>
>   $ guix archive --export git > git.nar
>   guix archive: error: build failed: program `guix-authenticate' failed with exit code 1

Is the guix-daemon also recent?

-- 
Ricardo

bug#33368: "guix archive" fails because of guix-authenticate

[Konrad Hinsen]

Hi Ludo and Ricardo,

> Could you strace the daemon and then re-run the command?
>
>   sudo strace -p $(pidof guix-daemon) -f -o daemon.log -s 234
>   guix archive --export sed > /dev/null
>
> I tested and it works for me, so we’ll have to see what’s going wrong
> behind the scenes.

With the strace log (see below) that's pretty obvious: the daemon
doesn't find the guix-authenticate binary. But where should it be, and
why is it missing on my machine?

> Is the guix-daemon also recent?

A bit less than the rest of guix, but I did update it after the Great
Pull Revolution. The first line of the strace log contains the path in
the store, which should say all there is to know about my daemon.

Cheers,
  Konrad.




15629 execve("/gnu/store/lm2zy00ciq5pb6gfibvakps7aa1hgz68-guix-daemon-0.15.0-6.f9a8fce/libexec/guix-authenticate", ["guix-authenticate", "rsautl", "-sign", "-inkey", "/etc/guix/signing-key.sec", "-in", "/tmp/nix-15338-0/hash"], 0x11542d0 /* 17 vars */) = -1 ENOENT (No such file or directory)
15629 execve("/usr/local/sbin/guix-authenticate", ["guix-authenticate", "rsautl", "-sign", "-inkey", "/etc/guix/signing-key.sec", "-in", "/tmp/nix-15338-0/hash"], 0x11542d0 /* 17 vars */) = -1 ENOENT (No such file or directory)
15629 execve("/usr/local/bin/guix-authenticate", ["guix-authenticate", "rsautl", "-sign", "-inkey", "/etc/guix/signing-key.sec", "-in", "/tmp/nix-15338-0/hash"], 0x11542d0 /* 17 vars */) = -1 ENOENT (No such file or directory)
15629 execve("/usr/sbin/guix-authenticate", ["guix-authenticate", "rsautl", "-sign", "-inkey", "/etc/guix/signing-key.sec", "-in", "/tmp/nix-15338-0/hash"], 0x11542d0 /* 17 vars */) = -1 ENOENT (No such file or directory)
15629 execve("/usr/bin/guix-authenticate", ["guix-authenticate", "rsautl", "-sign", "-inkey", "/etc/guix/signing-key.sec", "-in", "/tmp/nix-15338-0/hash"], 0x11542d0 /* 17 vars */) = -1 ENOENT (No such file or directory)
15629 execve("/sbin/guix-authenticate", ["guix-authenticate", "rsautl", "-sign", "-inkey", "/etc/guix/signing-key.sec", "-in", "/tmp/nix-15338-0/hash"], 0x11542d0 /* 17 vars */) = -1 ENOENT (No such file or directory)
15629 execve("/bin/guix-authenticate", ["guix-authenticate", "rsautl", "-sign", "-inkey", "/etc/guix/signing-key.sec", "-in", "/tmp/nix-15338-0/hash"], 0x11542d0 /* 17 vars */) = -1 ENOENT (No such file or directory)
15629 openat(AT_FDCWD, "/gnu/store/l4lr0f5cjd0nbsaaf8b5dmcw1a1yypr3-glibc-2.27/share/locale/en_US.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)

bug#33368: "guix archive" fails because of guix-authenticate

[Ludovic Courtès]

Hi!

Konrad Hinsen <konrad.hinsen@fastmail.net> skribis:

> 15629 execve("/gnu/store/lm2zy00ciq5pb6gfibvakps7aa1hgz68-guix-daemon-0.15.0-6.f9a8fce/libexec/guix-authenticate", ["guix-authenticate", "rsautl", "-sign", "-inkey", "/etc/guix/signing-key.sec", "-in", "/tmp/nix-15338-0/hash"], 0x11542d0 /* 17 vars */) = -1 ENOENT (No such file or directory)

Oops, this is fixed in commit 7a54b2281d1f60fd0ae2e058c219c5a600ad756b
(the next commit, 0fe1fba4af41f267c4bb2c006fb37f42422ab703, changes Guix
itself so that the script is installed as LIBEXECDIR/guix/authenticate,
for consistency.)

To test it, you’ll have to run ‘guix pull’ as root and to restart the
daemon.

Thanks,
Ludo’.

bug#33368: "guix archive" fails because of guix-authenticate

[Konrad Hinsen]

ludo@gnu.org (Ludovic Courtès) writes:

> Oops, this is fixed in commit 7a54b2281d1f60fd0ae2e058c219c5a600ad756b
> (the next commit, 0fe1fba4af41f267c4bb2c006fb37f42422ab703, changes Guix
> itself so that the script is installed as LIBEXECDIR/guix/authenticate,
> for consistency.)
>
> To test it, you’ll have to run ‘guix pull’ as root and to restart the
> daemon.

Done, works, thanks!

It would be nice if guix could detect an outdated daemon and ask for an
update. Technically that shouldn't be hard to do, but it requires
keeping a daemon API version number.

Konrad.

bug#33368: "guix archive" fails because of guix-authenticate

[Ludovic Courtès]

Konrad Hinsen <konrad.hinsen@fastmail.net> skribis:

> ludo@gnu.org (Ludovic Courtès) writes:
>
>> Oops, this is fixed in commit 7a54b2281d1f60fd0ae2e058c219c5a600ad756b
>> (the next commit, 0fe1fba4af41f267c4bb2c006fb37f42422ab703, changes Guix
>> itself so that the script is installed as LIBEXECDIR/guix/authenticate,
>> for consistency.)
>>
>> To test it, you’ll have to run ‘guix pull’ as root and to restart the
>> daemon.
>
> Done, works, thanks!
>
> It would be nice if guix could detect an outdated daemon and ask for an
> update. Technically that shouldn't be hard to do, but it requires
> keeping a daemon API version number.

There’s a protocol version that clients get during the handshake, so
clients could report about “old” daemons.

Now, the client-daemon protocol is meant to be backward-compatible and
to change rarely, so I’m not sure if we should warn about it.

Thoughts?

Thanks,
Ludo’.