GNU bug report logs - #35561
Fresh install, guix pull exits with error, hash mismatch

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 35561 in the body.
You can then email your comments to 35561 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Calle Kabo <calle <at> kabo.nu>
To: Bug Guix <bug-guix <at> gnu.org>
Subject: Fresh install, guix pull exits with error, hash mismatch
Date: Sat, 4 May 2019 09:43:17 +0200 (CEST)

[Message part 1 (text/plain, inline)]

manager <at> guix ~$ guix pullMigrating profile generations to '/var/guix/profiles/per-user/manager'...substitute: updating substitutes from 'https://ci.guix.gnu.org <https://ci.guix.gnu.org>'... 100.0%substitute: updating substitutes from 'https://ci.guix.gnu.org <https://ci.guix.gnu.org>'... 100.0%downloading from https://ci.guix.gnu.org/nar/gzip/1drx7dy1zakc0xs60nb0im1jbvxp11dj-isrgrootx1.pem <https://ci.guix.gnu.org/nar/gzip/1drx7dy1zakc0xs60nb0im1jbvxp11dj-isrgrootx1.pem>... isrgrootx1.pem  2KiB                                                                             634KiB/s 00:00 [##################] 100.0%downloading from https://ci.guix.gnu.org/nar/gzip/zh3s89l1kri7r5ya0bmhil65lm0my691-module-import <https://ci.guix.gnu.org/nar/gzip/zh3s89l1kri7r5ya0bmhil65lm0my691-module-import>... module-import  187B                                                                               81KiB/s 00:00 [##################] 100.0%downloading from https://ci.guix.gnu.org/nar/gzip/yl1vi61qmvvh83amwiwaik7s7jc03n5z-openssl-1.0.2p <https://ci.guix.gnu.org/nar/gzip/yl1vi61qmvvh83amwiwaik7s7jc03n5z-openssl-1.0.2p>... openssl-1.0.2p  2.2MiB                                                                           2.3MiB/s 00:01 [##################] 100.0%downloading from https://ci.guix.gnu.org/nar/gzip/lz72i155jfq364n97qgd6f2rj02mm7y1-module-import-compiled <https://ci.guix.gnu.org/nar/gzip/lz72i155jfq364n97qgd6f2rj02mm7y1-module-import-compiled>... module-import-compiled  45KiB                                                                    757KiB/s 00:00 [##################] 100.0%building /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv...downloading from https://letsencrypt.org/certs/letsencryptauthorityx3.pem <https://letsencrypt.org/certs/letsencryptauthorityx3.pem>...|sha256 hash mismatch for /gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem:  expected hash: 0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk  actual hash:   1kvac1dhm1d02bhrfj6l1cz1dpldz6ishb78zzvy8245zgvh7pdnhash mismatch for store item '/gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem'build of /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv failedView build log at '/var/log/guix/drvs/vf/1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv.bz2'.cannot build derivation `/gnu/store/paq8cw9f06lxw34aakk0vg1b9nx21cqf-le-certs-0.drv': 1 dependencies couldn't be builtguix pull: error: build of `/gnu/store/paq8cw9f06lxw34aakk0vg1b9nx21cqf-le-certs-0.drv' failed
I downloaded the expected file with 'guix download' from another source and tried 'guix pull' again. Then it failed on hash mismatch for letsencryptauthorityx4.pem instead.

[Message part 2 (text/html, inline)]

Message #8 received at 35561 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Calle Kabo <calle <at> kabo.nu>
Cc: 35561 <at> debbugs.gnu.org
Subject: Re: bug#35561: Fresh install, guix pull exits with error,
 hash mismatch
Date: Tue, 07 May 2019 00:33:56 +0200

Hi,

Calle Kabo <calle <at> kabo.nu> skribis:

> manager <at> guix ~$ guix pull

[...]

> building /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv...
> downloading from https://letsencrypt.org/certs/letsencryptauthorityx3.pem...
> |sha256 hash mismatch for /gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem:
>   expected hash: 0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk
>   actual hash:   1kvac1dhm1d02bhrfj6l1cz1dpldz6ishb78zzvy8245zgvh7pdn
> hash mismatch for store item '/gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem'

These 3 files are now available from https://ci.guix.gnu.org as
substitutes:

--8<---------------cut here---------------start------------->8---
$ sha1sum *.pem
af259e2e2ebd686861e3f89be6845298bed6c223  isrgrootx1.pem
36205ada14d1cded7e85294762630b6b57088198  letsencryptauthorityx3.pem
59057c31e97d8e10cc52edb389b1e87089a245aa  letsencryptauthorityx4.pem
$ for i in *.pem; do echo $(guix hash $i) $i ; done
0zhd1ps7sz4w1x52xk3v7ng6d0rcyi7y7rcrplwkmilnq5hzjv1y isrgrootx1.pem
0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk letsencryptauthorityx3.pem
003dc94c8qwj634h0dq743x7hqv9rdcfaisdksprkmi2jd107xq4 letsencryptauthorityx4.pem
--8<---------------cut here---------------end--------------->8---

and the ‘le-certs’ package itself is now available as a substitute from
ci.guix.gnu.org.

For the record, this failure stems from the combination of two issues:
(1) letsencrypt.org modified these PEM files in place, and (2) the old
copies had disappeared from ci.guix.gnu.org.  Fortunately they were still
on mirror.hydra.gnu.org, which is where I copied them frmo.

We should also update our ‘le-certs’ package definition to refer to the
new file hashes.

Ludo’.

Message #11 received at 35561 <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 35561 <at> debbugs.gnu.org, Calle Kabo <calle <at> kabo.nu>
Subject: Re: bug#35561: Fresh install, guix pull exits with error,
 hash mismatch
Date: Tue, 07 May 2019 00:59:08 +0200

[Message part 1 (text/plain, inline)]

Ludo',

Ludovic Courtès wrote:
> These 3 files are now available from https://ci.guix.gnu.org as
> substitutes:

Thanks!  I tried to help Calle with this on IRC yesterday but had 
to make due with my own little build farm (which had already 
collected 2 of the 3 files) and scp…

Did you do a fancier version of this, or is there a better 
(automated?) way we could handle this in future?

Kind regards,

T G-R

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 35561 <at> debbugs.gnu.org (full text, mbox):

From: Calle Kabo <calle <at> kabo.nu>
To: Tobias Geerinckx-Rice <me <at> tobias.gr>
Cc: 35561 <at> debbugs.gnu.org, Ludovic Courtès <ludo <at> gnu.org>
Subject: Re: bug#35561: Fresh install, guix pull exits with error, hash
 mismatch
Date: Tue, 7 May 2019 01:20:04 +0200 (CEST)

[Message part 1 (text/plain, inline)]

I tried running guix pull again, but still didn't work
https://paste.debian.net/1081770 <https://paste.debian.net/1081770>

Here's my config.scm
https://paste.debian.net/1081771 <https://paste.debian.net/1081771>

I then connected via VPN so I got an IP in the Netherlands, and le-certs downloaded just fine! So this may be a mirroring issue?

/Calle

[Message part 2 (text/html, inline)]

Message #17 received at 35561 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Calle Kabo <calle <at> kabo.nu>
Cc: 35561 <at> debbugs.gnu.org, Tobias Geerinckx-Rice <me <at> tobias.gr>
Subject: Re: bug#35561: Fresh install, guix pull exits with error,
 hash mismatch
Date: Tue, 07 May 2019 10:13:04 +0200

Hello,

Calle Kabo <calle <at> kabo.nu> skribis:

> I tried running guix pull again, but still didn't work
> https://paste.debian.net/1081770

This shows that substitutes were not used:

--8<---------------cut here---------------start------------->8---
41 building /gnu/store/2bahavdikdgvznc7yn1qmnpbw4pz0jnr-letsencryptauthorityx4.pem.drv...
42 downloading from https://letsencrypt.org/certs/letsencryptauthorityx4.pem...
43 |sha256 hash mismatch for /gnu/store/rrjqsmxk40fza2gra7pr9pbsdhbcbp0g-letsencryptauthorityx4.pem:
44   expected hash: 003dc94c8qwj634h0dq743x7hqv9rdcfaisdksprkmi2jd107xq4
45   actual hash:   0giiixknr0mls2ir6qqzb42mq7x9a7vz79gbn7fjszbf87pqhpzm
--8<---------------cut here---------------end--------------->8---

That’s why you get the exact same result as before.

The reason substitutes were not used is that Guix cached the fact that
substitutes weren’t available.  They became available in the meantime
but the cached entry hasn’t expired yet.

To work around it, you could wait some more :-), or you can do:

  guix pull --substitute-urls=https://berlin.guixsd.org

berlin.guixsd.org provides the same contents as ci.guix.gnu.org.
However, that will trick Guix into building a fresh cache for that
machine.

Let us know how it goes!

Ludo’.

Message #20 received at 35561 <at> debbugs.gnu.org (full text, mbox):

From: Calle Kabo <calle <at> kabo.nu>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 35561 <35561 <at> debbugs.gnu.org>, Tobias Geerinckx-Rice <me <at> tobias.gr>
Subject: Re: bug#35561: Fresh install, guix pull exits with error, hash
 mismatch
Date: Tue, 7 May 2019 10:39:22 +0200 (CEST)

[Message part 1 (text/plain, inline)]

Ah, right, so substitutes were used on my system, just not for this particular install.
Well, hopping on the VPN and getting a Dutch IP solved it for me and I'm no longer able to reproduce the issue.

/Calle

[Message part 2 (text/html, inline)]

Message #23 received at 35561 <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 35561 <at> debbugs.gnu.org
Subject: Re: bug#35561: Fresh install, guix pull exits with error,
 hash mismatch
Date: Tue, 07 May 2019 18:13:48 +0200

[Message part 1 (text/plain, inline)]

Ludo',

Ludovic Courtès wrote:
> The reason substitutes were not used is that Guix cached the 
> fact that
> substitutes weren’t available.  They became available in the 
> meantime
> but the cached entry hasn’t expired yet.
>
> To work around it, you could wait some more :-), or you can do:
>
>   guix pull --substitute-urls=https://berlin.guixsd.org
>
> berlin.guixsd.org provides the same contents as ci.guix.gnu.org.
> However, that will trick Guix into building a fresh cache for 
> that
> machine.

I just ‘sudo rm -rf /var/guix/substitute/cache/*’ when this 
happens, and it seems to work, but I'm curious why you didn't 
recommend it here.

Kind regards,

T G-R

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.