bug#66168: zsh home service breaks guix shell via ssh

bug#66168: zsh home service breaks guix shell via ssh

[Malte Frank Gerdes]

Hi,

i set up a new system last weekend and am connecting to it via ssh.  I
also just recently started using guix home.

I noticed that after connecting via ssh the profile that gets created
when doing `guix shell' is not sourced, therefore the environment
variables are not correct.  This seems to be because guix home inserts
"[ -n \"$SSH_CLIENT\" ] && source /etc/profile" into the zshenv file.  I
assume this is meant to ensure that /etc/profile is sourced because ssh
does not start a login shell?  Anyway, removing that line makes
everything work normally.  So am i doing it wrong or is this actually
unnecessary?


mfg²

bug#66168: zsh home service breaks guix shell via ssh

[Saku Laesvuori via Bug reports for GNU Guix]

[-- Attachment #1: Type: text/plain, Size: 1673 bytes --]

On Sat, Sep 23, 2023 at 12:19:10PM +0200, Malte Frank Gerdes wrote:
> I noticed that after connecting via ssh the profile that gets created
> when doing `guix shell' is not sourced, therefore the environment
> variables are not correct.  This seems to be because guix home inserts
> "[ -n \"$SSH_CLIENT\" ] && source /etc/profile" into the zshenv file.  I
> assume this is meant to ensure that /etc/profile is sourced because ssh
> does not start a login shell?

That is correct, it was added in <https://issues.guix.gnu.org/64765>
because commands like `ssh host -- cmd` (and commands depending on ssh
such as `git pull/push`) failed. 


> Anyway, removing that line makes everything work normally.  So am i
> doing it wrong or is this actually unnecessary?

I can reproduce this:

```
$ ssh localhost
$ guix shell gnuplot
$ gnuplot
zsh: command not found: gnuplot
```

However (still within the ssh session)

```
$ guix shell gnuplot -- gnuplot
[gnuplot opens as expected]
```

and weirdly enough

```
$ guix shell --check gnuplot
guix shell: checking the environment variables visible from shell '/gnu/store/i4rj0banq044423if5xwb3df723g14r9-zsh-5.9/bin/zsh'...
guix shell: All is good!  The shell gets correct environment variables.
$ gnuplot
zsh: command not found: gnuplot
```

I don't really know what is happening here. Why does it work when
running the command directly and why does `guix shell --check` claim
that everything is correct when clearly something is wrong? If I
understand correctly `.zshenv` should be sourced in all these cases but
for some reason the problems only occur in some of them.

Any ideas?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#66168: zsh home service breaks guix shell via ssh

[Malte Frank Gerdes]

Saku Laesvuori <saku@laesvuori.fi> writes:

> [[PGP Signed Part:Undecided]]
> On Sat, Sep 23, 2023 at 12:19:10PM +0200, Malte Frank Gerdes wrote:
>> I noticed that after connecting via ssh the profile that gets created
>> when doing `guix shell' is not sourced, therefore the environment
>> variables are not correct.  This seems to be because guix home inserts
>> "[ -n \"$SSH_CLIENT\" ] && source /etc/profile" into the zshenv file.  I
>> assume this is meant to ensure that /etc/profile is sourced because ssh
>> does not start a login shell?
>
> That is correct, it was added in <https://issues.guix.gnu.org/64765>
> because commands like `ssh host -- cmd` (and commands depending on ssh
> such as `git pull/push`) failed.
Ah, i didn't think about this use case.

>> Anyway, removing that line makes everything work normally.  So am i
>> doing it wrong or is this actually unnecessary?
>
> I can reproduce this:
>
> ```
> $ ssh localhost
> $ guix shell gnuplot
> $ gnuplot
> zsh: command not found: gnuplot
> ```
>
> However (still within the ssh session)
>
> ```
> $ guix shell gnuplot -- gnuplot
> [gnuplot opens as expected]
> ```
>
> and weirdly enough
>
> ```
> $ guix shell --check gnuplot
> guix shell: checking the environment variables visible from shell '/gnu/store/i4rj0banq044423if5xwb3df723g14r9-zsh-5.9/bin/zsh'...
> guix shell: All is good!  The shell gets correct environment variables.
> $ gnuplot
> zsh: command not found: gnuplot
> ```
>
> I don't really know what is happening here. Why does it work when
> running the command directly and why does `guix shell --check` claim
> that everything is correct when clearly something is wrong? If I
> understand correctly `.zshenv` should be sourced in all these cases but
> for some reason the problems only occur in some of them.
>
> Any ideas?
My guess would be that sourcing /etc/profile should only happen once,
but the SSH_CLIENT variable is inherited to the child shell which
evaluates zshenv which in turn sources /etc/profile because SSH_CLIENT
has non-zero length.  So /etc/profile is sourced twice.

This is just a wild guess though.


mfg²

bug#66168: zsh home service breaks guix shell via ssh

[Saku Laesvuori via Bug reports for GNU Guix]

[-- Attachment #1: Type: text/plain, Size: 2252 bytes --]

> > ```
> > $ ssh localhost
> > $ guix shell gnuplot
> > $ gnuplot
> > zsh: command not found: gnuplot
> > ```
> >
> > However (still within the ssh session)
> >
> > ```
> > $ guix shell gnuplot -- gnuplot
> > [gnuplot opens as expected]
> > ```
> >
> > and weirdly enough
> >
> > ```
> > $ guix shell --check gnuplot
> > guix shell: checking the environment variables visible from shell '/gnu/store/i4rj0banq044423if5xwb3df723g14r9-zsh-5.9/bin/zsh'...
> > guix shell: All is good!  The shell gets correct environment variables.
> > $ gnuplot
> > zsh: command not found: gnuplot
> > ```
> >
> > I don't really know what is happening here. Why does it work when
> > running the command directly and why does `guix shell --check` claim
> > that everything is correct when clearly something is wrong? If I
> > understand correctly `.zshenv` should be sourced in all these cases but
> > for some reason the problems only occur in some of them.
> >
> > Any ideas?
>
> My guess would be that sourcing /etc/profile should only happen once,
> but the SSH_CLIENT variable is inherited to the child shell which
> evaluates zshenv which in turn sources /etc/profile because SSH_CLIENT
> has non-zero length.  So /etc/profile is sourced twice.
> 
> This is just a wild guess though.

Seems to be about right. I had just assumed that guix shell would run
the command in a new shell (causing .zshenv to be sourced in all those
cases) but apparently it just calls the command directly. I haven't seen
any problems with sourcing /etc/profile multiple times because it
reloads both system and user profiles, but obviously it doesn't know
about guix shell profiles.

It seems that the default bash configuration only sources /etc/profile
if $SSH_CLIENT is non-empty and bash is used non-interactively.
Something similar could probably be done with zsh, but I would expect it
to still have this issue in certain situation. For example, I think
running a script like this

```
$ ssh host -- guix shell gnuplot <<EOF
...
EOF
```

would probably still fail.

I can't really think of any other possible solution than having an
environment variable that is set by /etc/profile and that makes sourcing
it a no-op.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]