Previously ‘guix weather’ would wait for the system timeout to be
triggered (typically more than 120s) when establishing a connection to a
substitute server.
* guix/scripts/weather.scm (guix-weather): Parameterize
‘default-connection-establishment-timeout’.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This fixes a regression introduced in 26d7eb8a4a
when running ‘guix-daemon’ without root privileges.
On rootless installations, we must abide by the usual file access rules, which
include the requirement that a directory be writable before it be renamed (the
rationale being that its ".." entry needs to be modified).
* guix/scripts/substitute.scm (rename-file*): New procedure.
(guix-substitute): Use it.
* tests/substitute.scm (directory-nar-sha256): New procedure.
(%narinfo/directory): New variable.
(call-with-narinfo): Add '#:directory?' keyword argument.
(with-directory-narinfo): New syntax.
("substitute, authorized key, directory"): New test case.
Fixes: guix/guix#9686
Change-Id: I9d399dd5f1717b7d02854d97e1100a0a464fac75
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #9702
Previously the cache key would be computed by prepending “channels/” to the
channel name. Thus, a channel defined like this:
(channel (name (symbol->string "../../../../PWND")) …)
… would lead to the creation of a file in $HOME.
This attack is accessible even with channel files evaluated in a sandbox, and
even if the channel is otherwise marked as trusted.
This change fixes that.
* guix/git-authenticate.scm (repository-cache-key): Deprecate.
(authenticate-repository): Change default value of #:cache-key.
(authenticated-commit-cache-file): Replace dots in KEY with dashes.
* guix/scripts/git/authenticate.scm (guix-git-authenticate): Use ‘commit’ as
the default value of ‘cache-key’.
* guix/channels.scm (maybe-link-old-cache): New procedure.
(authenticate-channel): Remove ‘cache-key’ and #:cache-key argument to
‘authenticate-repository’. Call ‘maybe-link-old-cache’.
Reported-by: Sergio Pastor Pérez <sergio.pastor-perez@inria.fr>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
The hash of a nar is only known once 'download-nar' completes. By that point
the nar may already have been partially-restored to its destination for some
time. Additionally, after a hash mismatch is detected, 'guix substitute'
leaves the invalid contents at the specified destination. This means that
untrusted, attacker-controlled contents are present at what at some point may
have been or at some point may become a valid store path. It is entirely
possible that a user or program won't check that a given store item is valid
before trying to use it (it may be that 'guix gc' was run while an obscured
reference was held). Let's protect them in that case by ensuring that
unverified contents are kept elsewhere, in a temporary directory.
While implementing this one such program was discovered: tests/substitute.scm.
It actually incorrectly computes the hashes of the nars it supplies to (guix
scripts substitute), computing the hash of the plain contents instead of the
hash of the nar. These tests nevertheless passed because they didn't check
what (guix scripts substitute) gave as output, instead only checking that the
expected contents were at the specified destination.
* guix/scripts/substitute.scm (call-with-temporary-directory-in): new
procedure.
(guix-substitute): use it to create a temporary directory next to the final
destination to restore the nar inside of. Once it is fully restored, if the
hash matches, move it to the final destination, deleting the file currently
there if it already exists.
* tests/substitute.scm (plain-file-nar-sha256): new procedure.
(%narinfo, "substitute, narinfo with several URLS" test): use it.
Change-Id: Ifeb9b4c912f9d9b2e7477d237da04e7d5175ff83
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
There are two potential places where file:// URIs could be used in 'guix
substitute':
1. The substitute urls, which are used for fetching narinfos. These can come
from the daemon, via daemon option "substitute-urls", from the client, via
daemon option "untrusted-substitute-urls", or from 'guix discover'. The
latter two must not be allowed to provide file:// URIs, since that could be
used to cause the daemon to read private files, files in /proc or /dev,
etc, and various parts of those files may show up in the backtrace from
'guix substitute'.
2. The narinfos themselves, which may offer arbitrarily many URIs to download
the nar of the store item in question. These URIs do not need to be
in the signed portion of the narinfo, so they may be attacker-controlled.
These should also not be allowed to provide file:// URIs, with the sole
exception being in the case of the test suite for the sake of simplifying
the tests.
To accomplish this, we error out of 'guix substitute' if
"untrusted-substitute-urls" includes a file:// URI, and we filter out all
file:// URIs from those provided by 'guix discover'. We also ignore all
narinfos containing file:// URIs unless '%allow-unsafe-substitute-uris?' is #t.
* guix/scripts/substitute.scm (%allow-unsafe-substitute-uris?,
%allow-unsafe-narinfo-uris?): new parameters.
(process-substitution, process-substitution/fallback): honor
'%allow-unsafe-substitute-uris?'.
(uri-safe?, narinfo-uris-safe?, assert-safe-uris): new procedures.
(%default-substitute-urls): use assert-safe-uris for the
"untrusted-substitute-urls" daemon option.
(%local-substitute-urls): filter out file:// URIs.
* tests/substitute.scm ("file:// URI prohibited by default"): new test. Set
'%allow-unsafe-substitute-uris?' to #t after it finishes.
Change-Id: I34d7e58b5a01c7cc61b52fcd61b547bba2ce4300
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
In the test environment it not only doesn't exist, it also cannot be created,
and this causes an exception to be thrown.
* guix/scripts/pull.scm (trusted-channels, channel-list): pass '#:ensure? #f' to
'config-directory'.
Change-Id: I52d28a9d4a6b4ab974ea7088dcdcc234fadbf5c8
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
The argument is required, not optional, so correct that.
* guix/scripts/import/crate.scm (%options)[lockfile]:
Mark argument as required.
Merges: https://issues.guix.gnu.org/81279
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>
This changes the default behavior of the 'npm-binary' importer to prefer using
pristine sources from Git when available, along with attempting to build the
package. It adds a '--binary' option to the importer to preserve the previous
behavior.
* guix/import/git.scm (get-tags): Export.
* guix/import/npm-binary.scm (<repository>): New JSON mapping.
(<package-revision>): Add a repository field.
(npm-package->package-sexp) [#:binary?]: New keyword. Update doc.
Conditionally splice #:phases argument.
<normalize-git-url, sexpify-git-tag/maybe>: New nested procedures.
(npm-package->package-sexp) [binary?]: Expand origin conditionally to BINARY?.
(npm-binary->guix-package) [#:binary?]: New keyword.
(npm-binary-recursive-import): Likewise.
* guix/import/utils.scm (git->origin) [#:eager?]: New keyword. Update doc.
* guix/scripts/import/npm-binary.scm (show-help): Document new --binary option.
(guix-import-npm-binary): Honor the new option.
Change-Id: I8e8c1c333faa8f5c96184ada064b63bdf2b4e165
* guix/scripts/home.scm: Add missing import of `operating-system-services` for
folding up `guix-home-service-type` in `ensure-home-environment`.
Signed-off-by: Andrew Tropin <andrew@trop.in>
Fixes a bug whereby ‘--allow-untrusted-channels’ (without arguments) would
have no effect.
* guix/scripts/pull.scm (%options): In ‘--allow-untrusted-channels’, handle #f
in the same way as "yes".
* guix/scripts/time-machine.scm (%options): Likewise.
Reported-by: Sergio Pastor Pérez <sergio.pastor-perez@inria.fr>
Change-Id: Ibdbf5f570fded420cb93d09411848fb4aa034245
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #9094
* guix/scripts/home.scm (process-action): Extract home environments from
`guix-home-service-type' extensions as well as the base service.
Reviewed-by: Andrew Tropin <andrew@trop.in>
Signed-off-by: Andrew Tropin <andrew@trop.in>
Time travel works in both directions, as mentioned in
info "(guix) Invoking guix time-machine".
* guix/scripts/time-machine.scm (show-help): Amend 'in an older version'
with 'in a different version'.
Change-Id: I5da267e58e64381de86d6711dcd104592c30ef6c
Merges: https://codeberg.org/guix/guix/pulls/1163
Reviewed-by: Andreas Enge <andreas@enge.fr>
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>
Fo guile to run, it needs pipe support: without pipe support it aborts at
startup. Pipe support is currently createn in runsystem by creating a
passive translator
settrans --create /servers/socket/1 /hurd/pflocal
However, this needs a writable root file-system, and runsystem is started with
a readonly root file-system.
This patch enables running guile early in runsystem, and thus prepares for
replacing the runsystem shell script with a guile program, by embedding the
servers/socket/1 passive translator into the hurd system image using xattr.
* gnu/build/hurd-boot.scm (make-hurd-device-nodes): Change optional root
parameter to keyword #:root. Add #:hurd keyword parameter. Use it to
create servers/socket/1 (pipe) and proc passive xattr translators.
* gnu/build/image.scm (initialize-root-partition): Update caller.
* gnu/system/image.scm (with-imported-modules*): Include (ice-9 optargs).
* gnu/system/images/hurd.scm (hurd-initialize-root-partition): Use it to
update caller.
* guix/scripts/system.scm (install): Update caller.
Change-Id: Ib3a672ae78bd969a2a4c0e33db8e38ccf71238ba
Merges: #8609
* guix/swh.scm (swhid-content-data): New procedure.
(call): Do not close ‘port’ when ‘result’ is the same as ‘port’.
* guix/scripts/pull.scm (swhid-content-data*): New procedure.
(channel-list): Accept ‘file’ as a SWHID.
* tests/guix-time-machine.sh: Add test.
* doc/guix.texi (Invoking guix pull): Document it.
(Invoking guix time-machine): Likewise.
Change-Id: I8145cd8685fe2926b1548d4a2dcd54804d89228a
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* guix/scripts/style.scm (input-matches?, package-list->string,
%field-accessors, remove-from-package-field, transform-package-field):
Add variables.
(%options): Add options --remove-input, --remove-native-input,
--remove-propagated-input, and --parameter.
(guix-style): Implement those options. To keep ony one autoload, use
specification->package+output rather than specification->package.
* tests/style.scm ("remove-input, single input removed",
"remove-input, one of multiple inputs removed",
"remove-input, middle input removed from list",
"remove-input, non-existent input unchanged",
"remove-input, input with output specifier",
"remove-native-input, single input removed",
"remove-native-input, one of multiple inputs removed",
"remove-native-input, does not affect inputs field",
"remove-propagated-input, single input removed",
"remove-propagated-input, one of multiple inputs removed",
"remove-propagated-input, does not affect other fields",
"remove-input from all three fields independently",
"remove-input, dry-run does not modify file"): New tests.
("url-fetch->git-fetch, preserved field"): Drop the use of %patch-path
and %package-module-path, which are not necessary because of -L.
Change the mocked procedure from specification->package to
specification->package+output, as in the implementation.
* doc/guix.texi (Invoking guix style): Add description for guix style
-S remove-*input rules.
Change-Id: I449c87930310a73ad316b4cb5db72d0906ea495d
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #5862
To test, use a sample home configuration and a command such as:
guix home container home.scm -- sleep 10
Before this commit, hitting `^C` would not have any effect, as `sleep`
does not explicitly register a signal handler for `SIGINT`. With this
commit, `guix home container` forwards the signal to `sleep`, which
then exits.
* guix/scripts/home.scm (spawn-home-container): Instruct
`eval/container` to not run our child directly as pid 1 in the spawned
container, as it may not expect to run as an init process.
Change-Id: Ib997a0386d0851978d197fbd2dfb139141d13065
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #8051
* guix/scripts/environment.scm (launch-environment/container): Instruct
`call-with-container` to not run the child as PID 1, which sets up a
simple signal proxying parent process to properly forward signals such
as `SIGINT` to the child.
Co-authored-by: Ludovic Courtès <ludo@gnu.org>
Change-Id: I8d435357f54b092562b461e0913aa58e63ecdbf9
Fixes: #7600
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* guix/scripts/gc.scm (%options): Error out when a non-root user tries
to vacuum the database.
Change-Id: Iee7d626c43980640aa91a3ceeb95675016932c55
Signed-off-by: jgart <jgart@dismail.de>
The tested AppImages were not actually relocatable and would rely on items
being available on the environment’s store (apart from glibc).
* guix/scripts/pack.scm (wrapped-manifest): New function.
(guix-pack): Extract relocatable manifest to wrapped-manifest.
* tests/pack.scm: Use relocatable profiles in AppImage tests.
Fixes: <https://issues.guix.gnu.org/76850>
Change-Id: Ib3123054913fce903d215dc0629d806e9fceebc7
Reported-by: Reepca Russelstein <reepca@russelstein.xyz>
Signed-off-by: Vagrant Cascadian <vagrant@debian.org>
The runtime-fuse3 binary was renamed to runtime.
* gnu/packages/appimage.scm (appimage-type2-runtime):
Update to continuous-1.caf24f9.
* guix/scripts/pack.scm (self-contained-appimage):
[runtime-path]: Use new runtime name.
Change-Id: Ibbb1fcb6ca914764c37addb62c8234b49cc93bd5
Signed-off-by: Vagrant Cascadian <vagrant@debian.org>
Both (guix channel) and (guix git-authenticate) use similar procedures.
To refactor the one in (guix git-authenticate), move the procedure
to (guix openpgp).
* guix/channels.scm: Replace autoloaded import
openpgp-public-key-fingerprint with openpgp-fingerprint->bytevector.
(openpgp-fingerprint->bytevector):
Move function definition from here...
* guix/openpgp.scm (openpgp-fingerprint->bytevector): ...to here.
* guix/git-authenticate.scm (read-authorizations):
Use openpgp-fingerprint->bytevector.
* guix/scripts/git/authenticate.scm:
Avoid using the (guix channels) module.
* tests/git-authenticate.scm : Likewise.
Change-Id: Ifd20588fcfaab601990098bd8575ee985e87394a
Reviewed-by: Danny Milosavljevic <dannym@friendly-machines.com>
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>
Previously ‘--save-provenance’ would be silently ignored for ‘guix system
image’.
* guix/scripts/system.scm (image-with-provenance): New procedure.
(process-action): In ‘transform’, add case for ‘image?’, and emit a warning in
the default case.
Change-Id: I5020a4b3dacbe7a0820a3c4779b7d86a8133bd60
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #7485
Previously, when the version tag could not be cloned, ‘generate-git-source’
would return #f leading ‘guix style’ to crash with a type error. Now, a
warning about the Git error is printed and ‘guix style’ keeps going.
* guix/scripts/style.scm (transform-to-git-fetch): Wrap ‘match’ clause in
‘catch’ and return #f on ‘git-error’.
Change-Id: If66b1c5f8e0a44155b96f3c54bab7c58aae406f8
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* guix/import/utils.scm (tarball-url->git-repository-url): New procedure.
* guix/scripts/style.scm (url-fetch->git-fetch)[transform-source]: Add
‘repository-url’ parameter.
Use ‘tarball-url->git-repository-url’ when ‘home-page’ is not a Git URL.
(transform-to-git-fetch): Rename ‘home-page’ to ‘repository-url’.
* tests/import/utils.scm ("tarball-url->git-repository-url, guile"): New test.
* tests/style.scm ("url-fetch->git-fetch, mirror:// URL"): New test.
Change-Id: I4f8ca7c67a58f917d69380678b62c00962b0f9cd
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Fixesguix/guix#6989.
* guix/scripts/pack.scm (debian-archive): When creating a Debian package
for an armhf-linux machine match our architecture to the closest one of
Debian's supported architectures.
Change-Id: I596db1087c507e61cc31f0808ebd9e39b4956c49
This reverts commit b6a070d2a3, which patched
git-lfs so its hooks would refer to a 'sh' from the store, but this reference
was at risk of going stale since the hooks are installed and preserved outside
the store. The shebangs are now patched in the `git-fetch' procedure
directly.
* guix/scripts/perform-download.scm (perform-git-download): Expand comment.
* guix/git-download.scm (bash-package): New variable.
(git-fetch/in-band*): Add #:bash argument.
(git-fetch-builder): Add it to `inputs', so that it gets added to PATH.
* guix/build/git.scm (git-fetch): Substitute /bin/bash in the post-checkout
git-lfs hook shebang.
Fixes: https://codeberg.org/guix/guix/issues/5616
Reported-by: Simon Josefsson <simon@josefsson.org>
Change-Id: Ife81737705bef5d0a1edad307ed77a479af4609e
This changes the behaviour for the first one or few nars the substitute script
downloads, with uncompressed and zstd compressed nars prefered rather than
picking by file size.
* guix/scripts/substitute.scm: (%default-fast-decompression?): Change to #t.
* tests/substitute.scm ("substitute, preferred nar URL is 404, other is 200"):
Adjust test.
Change-Id: I89202f084cd6b9d506bcb3d46f75de690c6986b5
To be consistent with other procedures that make network requests.
* guix/substitutes.scm (download-nar): Add #:keep-alive? option.
* guix/scripts/substitute.scm (process-substitution/fallback)
(process-substitution): Call download-nar with #:keep-alive? #t.
Change-Id: I83b27d0c3a0916d058fbbbeb7aa77dbb8a742768
From the substitutes script. This makes it possible to use download-nar in
the the Guile guix-daemon.
* guix/scripts/substitute.scm (%fetch-timeout): Move down to where it's now
used.
(%random-state, with-timeout, catch-system-error, http-response-error?,
download-nar): Move to…
* guix/substitutes.scm: …here.
Change-Id: I8c09bf4b33cb5c6d042057d4d9adeb36c24c11dc
This is in preparation for moving the download-nar procedure out of the
script.
As well as calling open-connection-for-uri/cached, with-cached-connection adds
a single retry to the expression passed in, in the case of a exception that
suggests there's a problem with the cached connection. This is important
because download-nar/http-fetch doesn't check if a connection used for
multiple requests should be closed (because the servers set the relevant
response header).
To make download-nar more generic, have it take open-connection-for-uri as a
keyword argument, and replicate the with-cached-connection single retry by
closing the port in the case of a network error, and recalling
open-connection-for-uri. This will work fine in the case when connection
caching is not in use, as well as when open-connection-for-uri/cached is used,
since open-connection-for-uri/cached will open a new connection if the cached
port is closed.
* guix/scripts/substitute.scm (kind-and-args-exception?): Remove and inline
where necessary.
(call-with-cached-connection): Remove procedure.
(with-cached-connection): Remove syntax rule.
(http-response-error?): New procedure.
(download-nar): Add new #:open-connection-for-uri keyword argument and use it,
also replace with-cached-connection.
(process-substitution/fallback,process-substitution): Pass
#:open-connection-for-uri open-connection-for-uri/cached to download-nar.
Change-Id: I277b1d8dfef79aa1711755b10b9944da7c19157c
Plus remove http-get-error? from network-error? as http-get-error? doesn't
indicate a network error.
* guix/scripts/substitute.scm (process-substitution/fallback)
(process-substitution): Use http-get-error? with network-error?.
(system-error?, network-error?): Move from here…
* guix/http-client.scm: …to here, and also don't use http-get-error?.
Change-Id: I61ee9e5fbf90ebb76a34aa8b9ec8f5d74f8a3c54
As this moves download-nar in a direction where it could be used outside the
substitute script.
* guix/scripts/substitute.scm (download-nar): Return expected and actual
hashes and move status-port output to guix-substitute.
(process-substitution/fallback): Remove port argument, and move output to port
to guix-substitute.
(process-substitution): Return hashes from download-nar or
process-substitution/fallback, plus the narinfo.
(guix-substitute): Don't pass the reply-port in to process-substitution and
implement the messages to the reply-port here.
Change-Id: Icbddb9a47620b3520cdd2e8095f37a99824c1ce0
Pulling the logic up to the script makes this code more portable and not
reliant on setting a global variable.
* guix/scripts/substitute.scm (%prefer-fast-decompression?): Rename to…
(%default-fast-decompression?): this.
(call-with-cpu-usage-monitoring): Use multiple values to return the results
from the thunk as well as the cpu usage.
(display-narinfo-data): Update accordingly.
(download-nar): Add fast-decompression? as a keyword argument, remove
code to set! it and monitor the cpu-usage.
(process-substitution, process-substitution/fallback): Accept and pass through
fast-decompression? to download-nar.
(guix-substitute): Move the cpu usage monitoring and fast decompression
switching logic here.
Change-Id: I4e80b457b55bcda8c0ff4ee224dd94a55e1b24fb
Rather than just the port and response-content-length. I'm looking at using
the response headers within the substitute script to work out when to close
the connection.
* guix/http-client.scm (http-fetch): Return the response as the second value,
rather than the response-content-length.
* guix/build/download-nar.scm (download-nar): Adapt accordingly.
* guix/build/download.scm (url-fetch): Adapt accordingly.
* guix/scripts/substitute.scm (process-substitution): Adapt accordingly.
* guix/scripts/challenge.scm (call-with-nar): Adapt accordingly.
Change-Id: I490ecf7cef1f5ebbf1e6ed026f6a8fc9dacc56be
Evgeny Pisemsky