GNU bug report logs -
#50892
[PATCH] guix-install.sh: Authorize all project build farms at once.
Previous Next
Reported by: Tobias Geerinckx-Rice <me <at> tobias.gr>
Date: Wed, 29 Sep 2021 15:44:02 UTC
Severity: normal
Tags: patch
Done: Ludovic Courtès <ludo <at> gnu.org>
Bug is archived. No further changes may be made.
To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 50892 in the body.
You can then email your comments to 50892 AT debbugs.gnu.org in the normal way.
Toggle the display of automated, internal messages from the tracker.
Report forwarded
to
guix-patches <at> gnu.org
:
bug#50892
; Package
guix-patches
.
(Wed, 29 Sep 2021 15:44:02 GMT)
Full text and
rfc822 format available.
Acknowledgement sent
to
Tobias Geerinckx-Rice <me <at> tobias.gr>
:
New bug report received and forwarded. Copy sent to
guix-patches <at> gnu.org
.
(Wed, 29 Sep 2021 15:44:02 GMT)
Full text and
rfc822 format available.
Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):
* etc/guix-install.sh (sys_authorize_build_farms):
Iterate over all hosts.
---
etc/guix-install.sh | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/etc/guix-install.sh b/etc/guix-install.sh
index b0d4a8b95e..e3b8485a50 100755
--- a/etc/guix-install.sh
+++ b/etc/guix-install.sh
@@ -1,21 +1,21 @@
#!/bin/sh
# GNU Guix --- Functional package management for GNU
# Copyright © 2017 sharlatan <sharlatanus <at> gmail.com>
# Copyright © 2018 Ricardo Wurmus <rekado <at> elephly.net>
# Copyright © 2018 Efraim Flashner <efraim <at> flashner.co.il>
-# Copyright © 2019, 2020 Tobias Geerinckx-Rice <me <at> tobias.gr>
+# Copyright © 2019–2021 Tobias Geerinckx-Rice <me <at> tobias.gr>
# Copyright © 2020 Morgan Smith <Morgan.J.Smith <at> outlook.com>
# Copyright © 2020 Simon Tournier <zimon.toutoune <at> gmail.com>
# Copyright © 2020 Daniel Brooks <db48x <at> db48x.net>
# Copyright © 2021 Jakub Kądziołka <kuba <at> kadziolka.net>
# Copyright © 2021 Chris Marusich <cmmarusich <at> gmail.com>
# Copyright © 2021 Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
#
# This file is part of GNU Guix.
#
# GNU Guix is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or (at
# your option) any later version.
#
# GNU Guix is distributed in the hope that it will be useful, but
@@ -476,38 +476,45 @@ sys_enable_guix_daemon()
;;
esac
_msg "${INF}making the guix command available to other users"
[ -e "$local_bin" ] || mkdir -p "$local_bin"
ln -sf "${var_guix}/bin/guix" "$local_bin"
[ -e "$info_path" ] || mkdir -p "$info_path"
for i in "${var_guix}"/share/info/*; do
ln -sf "$i" "$info_path"
done
}
sys_authorize_build_farms()
-{ # authorize the public key of the build farm
+{ # authorize the public key(s) of the build farm(s)
+ local hosts=(
+ ci.guix.gnu.org
+ bordeaux.guix.gnu.org
+ )
+
if prompt_yes_no "Permit downloading pre-built package binaries from the \
-project's build farm? (yes/no)"; then
- guix archive --authorize \
- < "~root/.config/guix/current/share/guix/ci.guix.gnu.org.pub" \
- && _msg "${PAS}Authorized public key for ci.guix.gnu.org"
- else
- _msg "${INF}Skipped authorizing build farm public keys"
+project's build farms? (yes/no)"; then
+ for host in "${hosts[@]}"; do
+ guix archive --authorize \
+ < "~root/.config/guix/current/share/guix/$host.pub" \
+ && _msg "${PAS}Authorized public key for $host"
+ done
+ else
+ _msg "${INF}Skipped authorizing build farm public keys"
fi
}
sys_create_init_profile()
{ # Define for better desktop integration
# This will not take effect until the next shell or desktop session!
[ -d "/etc/profile.d" ] || mkdir /etc/profile.d # Just in case
cat <<"EOF" > /etc/profile.d/guix.sh
# _GUIX_PROFILE: `guix pull` profile
_GUIX_PROFILE="$HOME/.config/guix/current"
export PATH="$_GUIX_PROFILE/bin${PATH:+:}$PATH"
# Export INFOPATH so that the updated info pages can be found
# and read by both /usr/bin/info and/or $GUIX_PROFILE/bin/info
# When INFOPATH is unset, add a trailing colon so that Emacs
# searches 'Info-default-directory-list'.
--
2.33.0
Information forwarded
to
guix-patches <at> gnu.org
:
bug#50892
; Package
guix-patches
.
(Wed, 29 Sep 2021 16:51:02 GMT)
Full text and
rfc822 format available.
Message #8 received at submit <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
Tobias Geerinckx-Rice via Guix-patches via 写道:
> + <
> "~root/.config/guix/current/share/guix/$host.pub" \
This file is missing for bordeaux in the 1.3.0 release, so this
would have to wait until the next one…
Kind regards,
T G-R
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
guix-patches <at> gnu.org
:
bug#50892
; Package
guix-patches
.
(Wed, 29 Sep 2021 16:51:02 GMT)
Full text and
rfc822 format available.
Information forwarded
to
guix-patches <at> gnu.org
:
bug#50892
; Package
guix-patches
.
(Wed, 29 Sep 2021 16:52:02 GMT)
Full text and
rfc822 format available.
Message #14 received at 50892 <at> debbugs.gnu.org (full text, mbox):
Tobias Geerinckx-Rice <me <at> tobias.gr> writes:
> * etc/guix-install.sh (sys_authorize_build_farms):
> Iterate over all hosts.
> ---
> etc/guix-install.sh | 23 +++++++++++++++--------
> 1 file changed, 15 insertions(+), 8 deletions(-)
>
> diff --git a/etc/guix-install.sh b/etc/guix-install.sh
> index b0d4a8b95e..e3b8485a50 100755
> --- a/etc/guix-install.sh
> +++ b/etc/guix-install.sh
> @@ -1,21 +1,21 @@
> #!/bin/sh
> # GNU Guix --- Functional package management for GNU
> # Copyright © 2017 sharlatan <sharlatanus <at> gmail.com>
> # Copyright © 2018 Ricardo Wurmus <rekado <at> elephly.net>
> # Copyright © 2018 Efraim Flashner <efraim <at> flashner.co.il>
> -# Copyright © 2019, 2020 Tobias Geerinckx-Rice <me <at> tobias.gr>
> +# Copyright © 2019–2021 Tobias Geerinckx-Rice <me <at> tobias.gr>
> # Copyright © 2020 Morgan Smith <Morgan.J.Smith <at> outlook.com>
> # Copyright © 2020 Simon Tournier <zimon.toutoune <at> gmail.com>
> # Copyright © 2020 Daniel Brooks <db48x <at> db48x.net>
> # Copyright © 2021 Jakub Kądziołka <kuba <at> kadziolka.net>
> # Copyright © 2021 Chris Marusich <cmmarusich <at> gmail.com>
> # Copyright © 2021 Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
> #
> # This file is part of GNU Guix.
> #
> # GNU Guix is free software; you can redistribute it and/or modify it
> # under the terms of the GNU General Public License as published by
> # the Free Software Foundation; either version 3 of the License, or (at
> # your option) any later version.
> #
> # GNU Guix is distributed in the hope that it will be useful, but
> @@ -476,38 +476,45 @@ sys_enable_guix_daemon()
> ;;
> esac
>
> _msg "${INF}making the guix command available to other users"
>
> [ -e "$local_bin" ] || mkdir -p "$local_bin"
> ln -sf "${var_guix}/bin/guix" "$local_bin"
>
> [ -e "$info_path" ] || mkdir -p "$info_path"
> for i in "${var_guix}"/share/info/*; do
> ln -sf "$i" "$info_path"
> done
> }
>
> sys_authorize_build_farms()
> -{ # authorize the public key of the build farm
> +{ # authorize the public key(s) of the build farm(s)
> + local hosts=(
> + ci.guix.gnu.org
> + bordeaux.guix.gnu.org
> + )
> +
> if prompt_yes_no "Permit downloading pre-built package binaries from the \
> -project's build farm? (yes/no)"; then
> - guix archive --authorize \
> - < "~root/.config/guix/current/share/guix/ci.guix.gnu.org.pub" \
> - && _msg "${PAS}Authorized public key for ci.guix.gnu.org"
> - else
> - _msg "${INF}Skipped authorizing build farm public keys"
> +project's build farms? (yes/no)"; then
> + for host in "${hosts[@]}"; do
> + guix archive --authorize \
> + < "~root/.config/guix/current/share/guix/$host.pub" \
> + && _msg "${PAS}Authorized public key for $host"
> + done
> + else
> + _msg "${INF}Skipped authorizing build farm public keys"
> fi
> }
>
> sys_create_init_profile()
> { # Define for better desktop integration
> # This will not take effect until the next shell or desktop session!
> [ -d "/etc/profile.d" ] || mkdir /etc/profile.d # Just in case
> cat <<"EOF" > /etc/profile.d/guix.sh
> # _GUIX_PROFILE: `guix pull` profile
> _GUIX_PROFILE="$HOME/.config/guix/current"
> export PATH="$_GUIX_PROFILE/bin${PATH:+:}$PATH"
> # Export INFOPATH so that the updated info pages can be found
> # and read by both /usr/bin/info and/or $GUIX_PROFILE/bin/info
> # When INFOPATH is unset, add a trailing colon so that Emacs
> # searches 'Info-default-directory-list'.
Tested on a VM:
./guix-install.sh: line 500: ~root/.config/guix/current/share/guix/bordeaux.guix.gnu.org.pub: No such file or directory
root <at> ubuntu:~# echo $?
1
I think we should fetch the keys from our online repo, so we can ensure
1. they are available
2. they are up to date.
Thanks!
Maxim
Information forwarded
to
guix-patches <at> gnu.org
:
bug#50892
; Package
guix-patches
.
(Thu, 08 Dec 2022 11:35:01 GMT)
Full text and
rfc822 format available.
Message #17 received at 50892 <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
Hi,
Tobias Geerinckx-Rice <me <at> tobias.gr> skribis:
> Tobias Geerinckx-Rice via Guix-patches via 写道:
>> + <
>> "~root/.config/guix/current/share/guix/$host.pub" \
>
> This file is missing for bordeaux in the 1.3.0 release, so this would
> have to wait until the next one…
If there are no objections I’d like to push to ‘master’ and
‘version-1.4.0’ this modified version of your patch.
Thanks,
Ludo’.
[0001-guix-install.sh-Authorize-all-project-build-farms-at.patch (text/x-patch, inline)]
From f13e03d57ae9784a349bfa2eab0285e2c5b58eb7 Mon Sep 17 00:00:00 2001
From: Tobias Geerinckx-Rice <me <at> tobias.gr>
Date: Wed, 29 Sep 2021 17:43:10 +0200
Subject: [PATCH] guix-install.sh: Authorize all project build farms at once.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* etc/guix-install.sh (sys_authorize_build_farms):
Iterate over all hosts.
Co-authored-by: Ludovic Courtès <ludo <at> gnu.org>
---
etc/guix-install.sh | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/etc/guix-install.sh b/etc/guix-install.sh
index 6bef21bb7e..fb9006b3e2 100755
--- a/etc/guix-install.sh
+++ b/etc/guix-install.sh
@@ -492,14 +492,22 @@ sys_enable_guix_daemon()
}
sys_authorize_build_farms()
-{ # authorize the public key of the build farm
+{ # authorize the public key(s) of the build farm(s)
+ local hosts=(
+ ci.guix.gnu.org
+ bordeaux.guix.gnu.org
+ )
+
if prompt_yes_no "Permit downloading pre-built package binaries from the \
-project's build farm?"; then
- guix archive --authorize \
- < ~root/.config/guix/current/share/guix/ci.guix.gnu.org.pub \
- && _msg "${PAS}Authorized public key for ci.guix.gnu.org"
- else
- _msg "${INF}Skipped authorizing build farm public keys"
+project's build farms?"; then
+ for host in "${hosts[@]}"; do
+ local key=~root/.config/guix/current/share/guix/$host.pub
+ [ -f "$key" ] \
+ && guix archive --authorize < "$key" \
+ && _msg "${PAS}Authorized public key for $host"
+ done
+ else
+ _msg "${INF}Skipped authorizing build farm public keys"
fi
}
--
2.38.1
Information forwarded
to
guix-patches <at> gnu.org
:
bug#50892
; Package
guix-patches
.
(Thu, 08 Dec 2022 21:28:01 GMT)
Full text and
rfc822 format available.
Message #20 received at 50892 <at> debbugs.gnu.org (full text, mbox):
Ludovic Courtès <ludo <at> gnu.org> writes:
> If there are no objections I’d like to push to ‘master’ and
> ‘version-1.4.0’ this modified version of your patch.
Thank you two, this patch works (on 1.3.0 only ci.guix.gnu.org, on
1.4.0rc1 also bordeaux, except when I decline authorization).
Regards,
Florian
Information forwarded
to
guix-patches <at> gnu.org
:
bug#50892
; Package
guix-patches
.
(Thu, 08 Dec 2022 21:47:02 GMT)
Full text and
rfc822 format available.
Message #23 received at 50892 <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
Ludovic Courtès 写道:
> If there are no objections I’d like to push to ‘master’ and
> ‘version-1.4.0’ this modified version of your patch.
No objections, thanks!
(Ugh, this patch is so ugly, all to work around that triplication
in ~/.config/guix/current/share/guix/*.pub… Would it be OK for
‘guix archive --authorize’ to silently ignore duplicate keys?)
Kind regards,
T G-R
[signature.asc (application/pgp-signature, inline)]
Reply sent
to
Ludovic Courtès <ludo <at> gnu.org>
:
You have taken responsibility.
(Fri, 09 Dec 2022 09:02:02 GMT)
Full text and
rfc822 format available.
Notification sent
to
Tobias Geerinckx-Rice <me <at> tobias.gr>
:
bug acknowledged by developer.
(Fri, 09 Dec 2022 09:02:02 GMT)
Full text and
rfc822 format available.
Message #28 received at 50892-done <at> debbugs.gnu.org (full text, mbox):
Hi,
"pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de> skribis:
> Ludovic Courtès <ludo <at> gnu.org> writes:
>> If there are no objections I’d like to push to ‘master’ and
>> ‘version-1.4.0’ this modified version of your patch.
>
> Thank you two, this patch works (on 1.3.0 only ci.guix.gnu.org, on
> 1.4.0rc1 also bordeaux, except when I decline authorization).
Pushed to both branches. Thanks to the two of you!
Ludo’.
Information forwarded
to
guix-patches <at> gnu.org
:
bug#50892
; Package
guix-patches
.
(Fri, 09 Dec 2022 09:11:01 GMT)
Full text and
rfc822 format available.
Message #31 received at 50892 <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
Hi,
Tobias Geerinckx-Rice <me <at> tobias.gr> skribis:
> (Ugh, this patch is so ugly, all to work around that triplication in
> ~/.config/guix/current/share/guix/*.pub… Would it be OK for ‘guix
> archive --authorize’ to silently ignore duplicate keys?)
Oh, good point. I guess we could change ‘public-keys->acl’ to
deduplicate entries. Maybe something along these lines:
[Message part 2 (text/x-patch, inline)]
diff --git a/guix/pki.scm b/guix/pki.scm
index 6326e065e9..c5b2fb9634 100644
--- a/guix/pki.scm
+++ b/guix/pki.scm
@@ -1,5 +1,5 @@
;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2016 Ludovic Courtès <ludo <at> gnu.org>
+;;; Copyright © 2013, 2014, 2016, 2022 Ludovic Courtès <ludo <at> gnu.org>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -21,6 +21,7 @@ (define-module (guix pki)
#:use-module (gcrypt pk-crypto)
#:use-module ((guix utils) #:select (with-atomic-file-output))
#:use-module ((guix build utils) #:select (mkdir-p))
+ #:autoload (srfi srfi-1) (delete-duplicates)
#:use-module (ice-9 match)
#:use-module (ice-9 rdelim)
#:use-module (ice-9 binary-ports)
@@ -61,9 +62,10 @@ (define (public-keys->acl keys)
;; want to have name certificates and to use subject names instead of
;; complete keys.
`(acl ,@(map (lambda (key)
- `(entry ,(canonical-sexp->sexp key)
+ `(entry ,key
(tag (guix import))))
- keys)))
+ (delete-duplicates
+ (map canonical-sexp->sexp keys)))))
(define %acl-file
(string-append %config-directory "/acl"))
[Message part 3 (text/plain, inline)]
WDYT?
Ludo’.
bug archived.
Request was from
Debbugs Internal Request <help-debbugs <at> gnu.org>
to
internal_control <at> debbugs.gnu.org
.
(Fri, 06 Jan 2023 12:24:11 GMT)
Full text and
rfc822 format available.
This bug report was last modified 1 year and 110 days ago.
Previous Next
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.