GNU bug report logs - #28659
Content-addressed mirror is not used upon invalid hash

Previous Next

Full log

View this message in rfc822 format

From: Ludovic Courtès <ludo <at> gnu.org>
To: Jan Nieuwenhuizen <janneke <at> gnu.org>
Cc: 39575 <at> debbugs.gnu.org, 28659 <at> debbugs.gnu.org, zimoun <zimon.toutoune <at> gmail.com>
Subject: bug#28659: bug#39575: guix time-machine fails when a tarball was modified in-place
Date: Fri, 14 Feb 2020 22:34:13 +0100

Jan Nieuwenhuizen <janneke <at> gnu.org> skribis:

> Ludovic Courtès writes:

[...]

>> The problem here is really that we fall back to content-addressed
>> mirrors instead of using them directly:
>>
>>   https://issues.guix.gnu.org/issue/28659
>
> Wait, what happened here; you finally proposed a patch two years ago and
> nothing happened/we all forgot to follow up?

I think we forgot, indeed.

One thing I don’t quite like about the patch is the fact that ‘guix
substitutes’ connects to the daemon in ‘content-addressed-item?’.

Also, one could argue that we’d steer users towards downloading from our
server, which could be a privacy concern (probably not a strong argument
since one can easily change the substitute URLs.)

Thoughts?

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.