GNU bug report logs - #45895
Channel authentication should start at the current commit(s)

Previous Next

Package: guix;

Reported by: Ludovic Courtès <ludo <at> gnu.org>

Date: Fri, 15 Jan 2021 17:45:01 UTC

Severity: important

Done: Ludovic Courtès <ludo <at> gnu.org>

Bug is archived. No further changes may be made.

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 45895 in the body.
You can then email your comments to 45895 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to bug-guix <at> gnu.org:
bug#45895; Package guix. (Fri, 15 Jan 2021 17:45:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Ludovic Courtès <ludo <at> gnu.org>:
New bug report received and forwarded. Copy sent to bug-guix <at> gnu.org. (Fri, 15 Jan 2021 17:45:02 GMT) Full text and rfc822 format available.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: <bug-guix <at> gnu.org>
Subject: Channel authentication should start at the current commit(s)
Date: Fri, 15 Jan 2021 18:44:49 +0100
Hi!

Currently, the first ‘guix pull’ (when ~/.cache/guix is empty)
authenticates starting from the introductory commit.  For the ‘guix’
channel, that’s 11K commits today, which takes about a minute to process
on modern hardware.

Authentication should instead consider the current commits, as returned
by ‘guix describe’, authenticated, and start from there.

For example, if you install Guix 1.3, authentication should start at the
‘v1.3’ commit.

Ludo’.




Severity set to 'important' from 'normal' Request was from Ludovic Courtès <ludo <at> gnu.org> to control <at> debbugs.gnu.org. (Fri, 15 Jan 2021 17:51:02 GMT) Full text and rfc822 format available.

Added blocking bug(s) 45896 Request was from Ludovic Courtès <ludo <at> gnu.org> to control <at> debbugs.gnu.org. (Sat, 16 Jan 2021 11:13:02 GMT) Full text and rfc822 format available.

Information forwarded to bug-guix <at> gnu.org:
bug#45895; Package guix. (Tue, 02 Feb 2021 08:47:02 GMT) Full text and rfc822 format available.

Message #12 received at 45895 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: 45895 <at> debbugs.gnu.org
Subject: Re: bug#45895: Channel authentication should start at the current
 commit(s)
Date: Tue, 02 Feb 2021 09:46:39 +0100
[Message part 1 (text/plain, inline)]
Hi,

Ludovic Courtès <ludo <at> gnu.org> skribis:

> Currently, the first ‘guix pull’ (when ~/.cache/guix is empty)
> authenticates starting from the introductory commit.  For the ‘guix’
> channel, that’s 11K commits today, which takes about a minute to process
> on modern hardware.
>
> Authentication should instead consider the current commits, as returned
> by ‘guix describe’, authenticated, and start from there.

The attached patch does that.

Ludo’.

[0001-channels-Consider-the-current-channel-commit-as-auth.patch (text/x-patch, inline)]
From 9bbce577036f2018d605d111042b0a7fc1be266b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= <ludo <at> gnu.org>
Date: Tue, 2 Feb 2021 09:37:33 +0100
Subject: [PATCH] channels: Consider the current channel commit as authentic.

Fixes <https://bugs.gnu.org/45895>.

When the ~/.cache/guix/authentication is empty, this change allows
authentication to start at the current commit, as shown by 'guix
describe', instead of starting from the introductory commit, which would
take more and more time (there's currently 18K commits per year).

* guix/git-authenticate.scm (authenticate-repository): Add #:authentic-commits.
[authenticated-commits]: Append it.
* guix/channels.scm (authenticate-channel)[authentic-commits]: New
variable.  Pass it to 'authenticate-repository'.
---
 guix/channels.scm         | 14 ++++++++++++++
 guix/git-authenticate.scm |  9 ++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/guix/channels.scm b/guix/channels.scm
index 3cc3b4c438..05226e766b 100644
--- a/guix/channels.scm
+++ b/guix/channels.scm
@@ -47,6 +47,7 @@
   #:use-module (srfi srfi-26)
   #:use-module (srfi srfi-34)
   #:use-module (srfi srfi-35)
+  #:autoload   (guix describe) (current-channels) ;XXX: circular dep
   #:autoload   (guix self) (whole-package make-config.scm)
   #:autoload   (guix inferior) (gexp->derivation-in-inferior) ;FIXME: circular dep
   #:autoload   (guix quirks) (%quirks %patches applicable-patch? apply-patch)
@@ -344,6 +345,18 @@ commits)...~%")
 
     (progress-reporter/bar (length commits)))
 
+  (define authentic-commits
+    ;; Consider the currently-used commit of CHANNEL as authentic so
+    ;; authentication can skip it and all its closure.
+    (match (find (lambda (candidate)
+                   (eq? (channel-name candidate) (channel-name channel)))
+                 (current-channels))
+      (#f '())
+      (channel
+       (if (channel-commit channel)
+           (list (channel-commit channel))
+           '()))))
+
   ;; XXX: Too bad we need to re-open CHECKOUT.
   (with-repository checkout repository
     (authenticate-repository repository
@@ -354,6 +367,7 @@ commits)...~%")
                              #:keyring-reference
                              (string-append keyring-reference-prefix
                                             keyring-reference)
+                             #:authentic-commits authentic-commits
                              #:make-reporter make-reporter
                              #:cache-key cache-key)))
 
diff --git a/guix/git-authenticate.scm b/guix/git-authenticate.scm
index 4ab5419bd6..ab3fcd8b2f 100644
--- a/guix/git-authenticate.scm
+++ b/guix/git-authenticate.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2019, 2020 Ludovic Courtès <ludo <at> gnu.org>
+;;; Copyright © 2019, 2020, 2021 Ludovic Courtès <ludo <at> gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -376,12 +376,14 @@ instead of '~a'")
                                   (cache-key (repository-cache-key repository))
                                   (end (reference-target
                                         (repository-head repository)))
+                                  (authentic-commits '())
                                   (historical-authorizations '())
                                   (make-reporter
                                    (const progress-reporter/silent)))
   "Authenticate REPOSITORY up to commit END, an OID.  Authentication starts
 with commit START, an OID, which must be signed by SIGNER; an exception is
-raised if that is not the case.  Return an alist mapping OpenPGP public keys
+raised if that is not the case.  Commits listed in AUTHENTIC-COMMITS and their
+closure are considered authentic.  Return an alist mapping OpenPGP public keys
 to the number of commits signed by that key that have been traversed.
 
 The OpenPGP keyring is loaded from KEYRING-REFERENCE in REPOSITORY, where
@@ -404,7 +406,8 @@ denoting the authorized keys for commits whose parent lack the
     (filter-map (lambda (id)
                   (false-if-git-not-found
                    (commit-lookup repository (string->oid id))))
-                (previously-authenticated-commits cache-key)))
+                (append (previously-authenticated-commits cache-key)
+                        authentic-commits)))
 
   (define commits
     ;; Commits to authenticate, excluding the closure of
-- 
2.30.0


Reply sent to Ludovic Courtès <ludo <at> gnu.org>:
You have taken responsibility. (Thu, 04 Feb 2021 12:48:01 GMT) Full text and rfc822 format available.

Notification sent to Ludovic Courtès <ludo <at> gnu.org>:
bug acknowledged by developer. (Thu, 04 Feb 2021 12:48:01 GMT) Full text and rfc822 format available.

Message #17 received at 45895-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: 45895-done <at> debbugs.gnu.org
Subject: Re: bug#45895: Channel authentication should start at the current
 commit(s)
Date: Thu, 04 Feb 2021 13:47:04 +0100
Ludovic Courtès <ludo <at> gnu.org> skribis:

>>From 9bbce577036f2018d605d111042b0a7fc1be266b Mon Sep 17 00:00:00 2001
> From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= <ludo <at> gnu.org>
> Date: Tue, 2 Feb 2021 09:37:33 +0100
> Subject: [PATCH] channels: Consider the current channel commit as authentic.
>
> Fixes <https://bugs.gnu.org/45895>.
>
> When the ~/.cache/guix/authentication is empty, this change allows
> authentication to start at the current commit, as shown by 'guix
> describe', instead of starting from the introductory commit, which would
> take more and more time (there's currently 18K commits per year).
>
> * guix/git-authenticate.scm (authenticate-repository): Add #:authentic-commits.
> [authenticated-commits]: Append it.
> * guix/channels.scm (authenticate-channel)[authentic-commits]: New
> variable.  Pass it to 'authenticate-repository'.

Pushed as 29009fdb2d3636eafa77b406da2430b08a22d47e.

Ludo’.




bug archived. Request was from Debbugs Internal Request <help-debbugs <at> gnu.org> to internal_control <at> debbugs.gnu.org. (Fri, 05 Mar 2021 12:24:09 GMT) Full text and rfc822 format available.

This bug report was last modified 3 years and 24 days ago.

Previous Next


GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.