GNU bug report logs - #28659
Content-addressed mirror is not used upon invalid hash

Previous Next

Package: guix;

Reported by: Jan Nieuwenhuizen <janneke <at> gnu.org>

Date: Sun, 1 Oct 2017 10:17:02 UTC

Severity: important

Merged with 70588

Full log


View this message in rfc822 format

From: Jan Nieuwenhuizen <janneke <at> gnu.org>
To: 28659 <at> debbugs.gnu.org
Subject: bug#28659: v0.13: guix pull fails; libgit2-0.26.0 and 0.25.1 content hashes fail
Date: Sun, 01 Oct 2017 12:16:07 +0200
Hi!

As reported by laertus on irc[0]: guix pull on 0.13 without substitutes fails

      guix pull

    Starting download of /tmp/guix-file.3r6cH0
    From https://git.savannah.gnu.org/cgit/guix.git/snapshot/master.tar.gz...
     ….tar.gz                                   5.7MiB/s 00:02 | 13.6MiB transferred
    unpacking '/gnu/store/sginfwnrcfqn1far31gmzlaffd8xlxyy-guix-latest.tar.gz'...

    Starting download of /gnu/store/c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar.gz
    From https://github.com/libgit2/libgit2/archive/v0.25.1.tar.gz...
    following redirection to `https://codeload.github.com/libgit2/libgit2/tar.gz/v0.25.1'...
     v0.25.1                                     6.1MiB/s 00:01 | 4.1MiB transferred
    output path `/gnu/store/c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar.gz' should have sha256 hash `1cdwcw38frc1wf28x5ppddazv9hywc718j92f3xa3ybzzycyds3s', instead has `0ywcxw1mwd56c8qc14hbx31bf198gxck3nja3laxyglv7l57qp26'
    cannot build derivation `/gnu/store/z1ky970mnamnbairnpyxxb72qnc485zq-libgit2-0.25.1.drv': 1 dependencies couldn't be built
    cannot build derivation `/gnu/store/rl7ms8rmbywvydy4qf656g1sdfxafb7r-guile-git-0.0-2.06f9fc3.drv': 1 dependencies couldn't be built
    guix pull: error: build failed: build of `/gnu/store/rl7ms8rmbywvydy4qf656g1sdfxafb7r-guile-git-0.0-2.06f9fc3.drv' failed

because the libgit2-0.25.1 content hash does not check out.

I verified this on version-0.13.  The same goes for 0.26.0 on master

    $ guix build -S libgit2 --no-substitutes
    The following derivations will be built:
       /gnu/store/5szrmzmfgxk6pylk5fh9bk8apj4x8axf-libgit2-0.26.0.tar.xz.drv
       /gnu/store/mgh4yjxkxfyqmc7c61vwq4vs8v837602-libgit2-0.26.0.tar.gz.drv
    @ build-started /gnu/store/mgh4yjxkxfyqmc7c61vwq4vs8v837602-libgit2-0.26.0.tar.gz.drv - x86_64-linux /var/log/guix/drvs/mg//h4yjxkxfyqmc7c61vwq4vs8v837602-libgit2-0.26.0.tar.gz.drv.bz2

    Starting download of /gnu/store/53lj4z9cavl7n27r89zjnvyd8fk854kj-libgit2-0.26.0.tar.gz
    From https://github.com/libgit2/libgit2/archive/v0.26.0.tar.gz...
    following redirection to `https://codeload.github.com/libgit2/libgit2/tar.gz/v0.26.0'...
     v0.26.0  4.5MiB                    3.1MiB/s 00:01 [####################] 100.0%
    sha256 hash mismatch for output path `/gnu/store/53lj4z9cavl7n27r89zjnvyd8fk854kj-libgit2-0.26.0.tar.gz'
      expected: 1fdk9yhwvl1w1z71ykzcvgh4nsf8scxcbclz5anh98zpplmhmisa
      actual:   1b3figbhp5l83vd37vq6j2narrq4yl9pfw6mw0px0dzb1hz3jqka
    @ build-failed /gnu/store/mgh4yjxkxfyqmc7c61vwq4vs8v837602-libgit2-0.26.0.tar.gz.drv - 1 sha256 hash mismatch for output path `/gnu/store/53lj4z9cavl7n27r89zjnvyd8fk854kj-libgit2-0.26.0.tar.gz'
      expected: 1fdk9yhwvl1w1z71ykzcvgh4nsf8scxcbclz5anh98zpplmhmisa
      actual:   1b3figbhp5l83vd37vq6j2narrq4yl9pfw6mw0px0dzb1hz3jqka
    cannot build derivation `/gnu/store/5szrmzmfgxk6pylk5fh9bk8apj4x8axf-libgit2-0.26.0.tar.xz.drv': 1 dependencies couldn't be built
    guix build: error: build failed: build of `/gnu/store/5szrmzmfgxk6pylk5fh9bk8apj4x8axf-libgit2-0.26.0.tar.xz.drv' failed

I found no apparent difference in the content

    -r--r--r-- 1 janneke janneke  4252130 Oct  1 09:08 c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar.gz
    -rw-r--r-- 1 janneke janneke  4252139 Oct  1 09:09 NEW-c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar.gz
    -rw-r--r-- 1 janneke janneke 16363520 Oct  1 09:14 c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar
    -rw-r--r-- 1 janneke janneke 16363520 Oct  1 09:14 NEW-c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar

but there's this difference between the tar balls...

    12:13:57 janneke <at> dundal:~/src/guix-0.13 
    $ cmp -l c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar NEW-c3npgqn9ag2ypi9bda1g779wwwlcqqrf-libgit2-0.25.1.tar
    13122049   0 157
    13122050   0 162
    13122051   0 151
    13122052   0 147
    13122053   0 151
    13122054   0 156
    13122055   0  57
    13122490  57   0
    13122491 157   0
    13122492 162   0
    13122493 151   0
    13122494 147   0
    13122495 151   0
    13122496 156   0
    13270529   0 157
    13270530   0 162
    13270531   0 151
    13270532   0 147
    13270533   0 151
    13270534   0 156
    13270535   0  57
    13270972  57   0
    13270973 157   0
    13270974 162   0
    13270975 151   0
    13270976 147   0
    13270977 151   0
    13270978 156   0
    13294081   0 157
    13294082   0 162
    13294083   0 151
    13294084   0 147
    13294085   0 151
    13294086   0 156
    13294087   0  57
    13294519  57   0
    13294520 157   0
    13294521 162   0
    13294522 151   0
    13294523 147   0
    13294524 151   0
    13294525 156   0

janneke

[0] https://gnunet.org/bot/log/guix/2017-10-01#T1517584

-- 
Jan Nieuwenhuizen <janneke <at> gnu.org> | GNU LilyPond http://lilypond.org
Freelance IT http://JoyofSource.com | Avatar® http://AvatarAcademy.com




This bug report was last modified 1 year and 43 days ago.

Previous Next


GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.