bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Tobias Geerinckx-Rice]

Ludo',

Ludovic Courtès wrote:
The reason substitutes were not used is that Guix cached the 
fact that
substitutes weren’t available.  They became available in the 
meantime

but the cached entry hasn’t expired yet.

To work around it, you could wait some more :-), or you can do:

  guix pull --substitute-urls=https://berlin.guixsd.org

berlin.guixsd.org provides the same contents as ci.guix.gnu.org.
However, that will trick Guix into building a fresh cache for 
that

machine.


I just ‘sudo rm -rf /var/guix/substitute/cache/*’ when this 
happens, and it seems to work, but I'm curious why you didn't 
recommend it here.


Kind regards,

T G-R


signature.asc
Description: PGP signature

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Calle Kabo]

Ah, right, so substitutes were used on my system, just not for this particular 
install.
Well, hopping on the VPN and getting a Dutch IP solved it for me and I'm no 
longer able to reproduce the issue.

/Calle

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Ludovic Courtès]

Hello,

Calle Kabo  skribis:

> I tried running guix pull again, but still didn't work
> https://paste.debian.net/1081770

This shows that substitutes were not used:

--8<---cut here---start->8---
41 building 
/gnu/store/2bahavdikdgvznc7yn1qmnpbw4pz0jnr-letsencryptauthorityx4.pem.drv...
42 downloading from https://letsencrypt.org/certs/letsencryptauthorityx4.pem...
43 |sha256 hash mismatch for 
/gnu/store/rrjqsmxk40fza2gra7pr9pbsdhbcbp0g-letsencryptauthorityx4.pem:
44   expected hash: 003dc94c8qwj634h0dq743x7hqv9rdcfaisdksprkmi2jd107xq4
45   actual hash:   0giiixknr0mls2ir6qqzb42mq7x9a7vz79gbn7fjszbf87pqhpzm
--8<---cut here---end--->8---

That’s why you get the exact same result as before.

The reason substitutes were not used is that Guix cached the fact that
substitutes weren’t available.  They became available in the meantime
but the cached entry hasn’t expired yet.

To work around it, you could wait some more :-), or you can do:

  guix pull --substitute-urls=https://berlin.guixsd.org

berlin.guixsd.org provides the same contents as ci.guix.gnu.org.
However, that will trick Guix into building a fresh cache for that
machine.

Let us know how it goes!

Ludo’.

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Calle Kabo]

I tried running guix pull again, but still didn't work
https://paste.debian.net/1081770 

Here's my config.scm
https://paste.debian.net/1081771 

I then connected via VPN so I got an IP in the Netherlands, and le-certs 
downloaded just fine! So this may be a mirroring issue?

/Calle

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Tobias Geerinckx-Rice]

Ludo',

Ludovic Courtès wrote:

These 3 files are now available from https://ci.guix.gnu.org as
substitutes:


Thanks!  I tried to help Calle with this on IRC yesterday but had 
to make due with my own little build farm (which had already 
collected 2 of the 3 files) and scp…


Did you do a fancier version of this, or is there a better 
(automated?) way we could handle this in future?


Kind regards,

T G-R


signature.asc
Description: PGP signature

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Ludovic Courtès]

Hi,

Calle Kabo  skribis:

> manager@guix ~$ guix pull

[...]

> building 
> /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv...
> downloading from https://letsencrypt.org/certs/letsencryptauthorityx3.pem...
> |sha256 hash mismatch for 
> /gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem:
>   expected hash: 0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk
>   actual hash:   1kvac1dhm1d02bhrfj6l1cz1dpldz6ishb78zzvy8245zgvh7pdn
> hash mismatch for store item 
> '/gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem'

These 3 files are now available from https://ci.guix.gnu.org as
substitutes:

--8<---cut here---start->8---
$ sha1sum *.pem
af259e2e2ebd686861e3f89be6845298bed6c223  isrgrootx1.pem
36205ada14d1cded7e85294762630b6b57088198  letsencryptauthorityx3.pem
59057c31e97d8e10cc52edb389b1e87089a245aa  letsencryptauthorityx4.pem
$ for i in *.pem; do echo $(guix hash $i) $i ; done
0zhd1ps7sz4w1x52xk3v7ng6d0rcyi7y7rcrplwkmilnq5hzjv1y isrgrootx1.pem
0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk letsencryptauthorityx3.pem
003dc94c8qwj634h0dq743x7hqv9rdcfaisdksprkmi2jd107xq4 letsencryptauthorityx4.pem
--8<---cut here---end--->8---

and the ‘le-certs’ package itself is now available as a substitute from
ci.guix.gnu.org.

For the record, this failure stems from the combination of two issues:
(1) letsencrypt.org modified these PEM files in place, and (2) the old
copies had disappeared from ci.guix.gnu.org.  Fortunately they were still
on mirror.hydra.gnu.org, which is where I copied them frmo.

We should also update our ‘le-certs’ package definition to refer to the
new file hashes.

Ludo’.

bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Calle Kabo]

manager@guix ~$ guix pullMigrating profile generations to 
'/var/guix/profiles/per-user/manager'...substitute: updating substitutes from 
'https://ci.guix.gnu.org '... 100.0%substitute: 
updating substitutes from 'https://ci.guix.gnu.org 
'... 100.0%downloading from 
https://ci.guix.gnu.org/nar/gzip/1drx7dy1zakc0xs60nb0im1jbvxp11dj-isrgrootx1.pem
 
...
 isrgrootx1.pem  2KiB   
  634KiB/s 00:00 [##] 100.0%downloading from 
https://ci.guix.gnu.org/nar/gzip/zh3s89l1kri7r5ya0bmhil65lm0my691-module-import 
...
 module-import  187B
   81KiB/s 00:00 [##] 100.0%downloading from 
https://ci.guix.gnu.org/nar/gzip/yl1vi61qmvvh83amwiwaik7s7jc03n5z-openssl-1.0.2p
 
...
 openssl-1.0.2p  2.2MiB 
  2.3MiB/s 00:01 [##] 100.0%downloading from 
https://ci.guix.gnu.org/nar/gzip/lz72i155jfq364n97qgd6f2rj02mm7y1-module-import-compiled
 
...
 module-import-compiled  45KiB  
  757KiB/s 00:00 [##] 100.0%building 
/gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv...downloading
 from https://letsencrypt.org/certs/letsencryptauthorityx3.pem 
...|sha256 hash 
mismatch for 
/gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem:  
expected hash: 0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk  actual 
hash:   1kvac1dhm1d02bhrfj6l1cz1dpldz6ishb78zzvy8245zgvh7pdnhash mismatch for 
store item 
'/gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem'build 
of /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv 
failedView build log at 
'/var/log/guix/drvs/vf/1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv.bz2'.cannot
 build derivation `/gnu/store/paq8cw9f06lxw34aakk0vg1b9nx21cqf-le-certs-0.drv': 
1 dependencies couldn't be builtguix pull: error: build of 
`/gnu/store/paq8cw9f06lxw34aakk0vg1b9nx21cqf-le-certs-0.drv' failed
I downloaded the expected file with 'guix download' from another source and 
tried 'guix pull' again. Then it failed on hash mismatch for 
letsencryptauthorityx4.pem instead.