GNU bug report logs - #52517
inconstency with offloading

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#52517: closed (inconstency with offloading)
Date: Mon, 03 Jan 2022 18:31:01 +0000

[Message part 1 (text/plain, inline)]

Your message dated Mon, 03 Jan 2022 19:30:37 +0100
with message-id <87k0fgfz8y.fsf <at> gnu.org>
and subject line Re: bug#52517: inconstency with offloading
has caused the debbugs.gnu.org bug report #52517,
regarding inconstency with offloading
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
52517: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=52517
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: zimoun <zimon.toutoune <at> gmail.com>
To: bug-guix <at> gnu.org
Subject: inconstency with offloading
Date: Wed, 15 Dec 2021 18:02:52 +0100

Hi,

The manual provides [1] the example:

--8<---------------cut here---------------start------------->8---
      (build-machine
        (name "armeight.example.org")
        (systems (list "aarch64-linux"))
        (host-key "ssh-rsa AAAAB3Nza…")
        (user "alice")
        (private-key
         (string-append (getenv "HOME")
                        "/.ssh/identity-for-guix")))
--8<---------------cut here---------------end--------------->8---

but what is not clear is 'getenv' from who.  Concretly, adding 'pk' it
reads:

--8<---------------cut here---------------start------------->8---
$ guix offload test

;;; ("/home/simon")
guix offload: testing 2 build machines defined in '/etc/guix/machines.scm'...
--8<---------------cut here---------------end--------------->8---

however, when really building with offload:

--8<---------------cut here---------------start------------->8---
$ guix build -L /tmp/mine r-cipr
The following derivation will be built:
   /gnu/store/mzixy5hhx79xx33k03acaasml87c0knc-r-cipr-0.1.0-1.4b01bb8.drv

;;; ("/root")
process 6815 acquired build slot '/var/guix/offload/x.x.x.x:22/0'
process 6815 acquired build slot '/var/guix/offload/x.x.x.x:22/0'
normalized load on machine 'x.x.x.x' is 0.00
--8<---------------cut here---------------end--------------->8---


"guix offload tes" does the correct thing, not "guix build".


Cheers,
simon


1: <https://guix.gnu.org/en/manual/devel/en/guix.html#Daemon-Offload-Setup>

[Message part 3 (message/rfc822, inline)]

From: Ludovic Courtès <ludo <at> gnu.org>
To: zimoun <zimon.toutoune <at> gmail.com>
Cc: 52517-done <at> debbugs.gnu.org
Subject: Re: bug#52517: inconstency with offloading
Date: Mon, 03 Jan 2022 19:30:37 +0100

Hi,

zimoun <zimon.toutoune <at> gmail.com> skribis:

> On Mon, 03 Jan 2022 at 17:52, Ludovic Courtès <ludo <at> gnu.org> wrote:
>
>> This is because guix-daemon spawns ‘guix offload’ as root.
>
> Yes.  The issue is I cannot offload to a machine where I have an SSH
> account and where Guix is installed if the sysadmin does not configure
> correctly this /root/.ssh/.

True.  That’s admittedly not as flexible as it could be.

Interestingly, GUIX_DAEMON_SOCKET=ssh://… almost achieves that.

Perhaps we could implement “user-level offloading”, probably in addition
to system-wide offloading?  Food for thought…

>> diff --git a/doc/guix.texi b/doc/guix.texi
>> index 43549da388..9c1f30e83f 100644
>> --- a/doc/guix.texi
>> +++ b/doc/guix.texi
>> @@ -1250,9 +1250,10 @@ The @file{/etc/guix/machines.scm} file typically looks like this:
>>          (systems (list "aarch64-linux"))
>>          (host-key "ssh-rsa AAAAB3Nza <at> dots{}")
>>          (user "alice")
>> -        (private-key
>> -         (string-append (getenv "HOME")
>> -                        "/.ssh/identity-for-guix"))))
>> +
>> +        ;; Remember 'guix offload' is spawned by
>> +        ;; 'guix-daemon' as root.
>> +        (private-key "/root/.ssh/identity-for-guix")))
>
> This patch LGTM.  At least, it could save time for people configuring
> offload. :-)

Alright, committing.

> I am fine to close the issue but, as I said, the fix seems to be able to
> offload without root access but just an SSH access.

Yes, we can discuss that separately.

A simple design would be to have clients install a “build handler”; when
the handler is called, it selects a machine, open a remote store
connection, copies missing inputs, starts the build, retrieves
outputs—all that from the client.  Of course admins still have to
authorize keys both ways, but at least that gives more flexibility.  (We
could also have a model where keys are authorized just one-way.)

Thanks,
Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.