GNU bug report logs - #76660
Downgrade prevention triggers erroneously with 'guix pull'

Previous Next

Full log

Message #38 received at 76660 <at> debbugs.gnu.org (full text, mbox):

From: Tomas Volf <~@wolfsden.cz>
To: Leo Famulari <leo <at> famulari.name>
Cc: Jack Hill <jackhill <at> jackhill.us>, 76660 <at> debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Mon, 10 Mar 2025 00:38:20 +0100

[Message part 1 (text/plain, inline)]

Leo Famulari <leo <at> famulari.name> writes:

> On Sun, Mar 09, 2025 at 10:33:45AM +0100, Tomas Volf wrote:
>> I think it could be influenced by the commit you are currently on, and
>> the commit you are pulling as latest.  So depending on time of previous
>> and current pull, it might work or it might not work.  I assume that
>> limits the amount of affected people.
>
> Yes, it might or might not work. Some of us can pull from the "bad
> commit", and some of us can't:
>
> https://issues.guix.gnu.org/76660#6
>
> So, either we don't understand all the conditions that trigger this bug,
> or it's not deterministic. But we should work to get the fix into
> guile-git.

There is nothing to fix in guile-git, the fix needs to go into (guix
git).  The libgit2 (which guile-git is wrapping) simply does not
guarantee that two gets of the same commit hash will return identical
pointer.  So I believe (guix git) is in the wrong here for using eq?.

Well, I guess guile-git could go beyond what libgit2 promises, and
introduce its own caching layer, but I am not sure that is the correct
course of action.  But its up to Ludo' of course.

Tomas

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.