bug#38857: X.509 certificate of 'crates.io' could not be verified during a recursive import from crates.io

[Valentin Ignatev]

Hi! I'm trying to recursively import a package from crates.io like this:

guix import crate notify@4.0.14 --recursive

It follows redirections for a while untill at some point throws this:

Backtrace:
          12 (primitive-load "/home/vj/.config/guix/current/bin/guix")
In guix/ui.scm:
  1806:12 11 (run-guix-command _ . _)
In guix/scripts/import.scm:
   116:11 10 (guix-import . _)
In guix/scripts/import/crate.scm:
   103:16  9 (guix-import-crate . _)
In guix/import/utils.scm:
    425:7  8 (recursive-import _ _ #:repo->guix-package _ #:guix-name …)
   397:31  7 (topological-sort _ #<procedure 7f9a59729630 at guix/i…> …)
In srfi/srfi-1.scm:
   592:17  6 (map1 ("tempfile"))
In guix/import/utils.scm:
   421:36  5 (lookup-node "tempfile")
In guix/import/crate.scm:
   222:10  4 (crate->guix-package "tempfile" _)
   150:15  3 (make-crate-sexp #:name _ #:version _ #:cargo-inputs _ # …)
In guix/http-client.scm:
    88:25  2 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ # …)
In guix/build/download.scm:
    419:4  1 (open-connection-for-uri _ #:timeout _ # _)
    306:6  0 (tls-wrap #<closed: file 7f9a564b3a10> _ # _)

guix/build/download.scm:306:6: In procedure tls-wrap:
X.509 certificate of 'crates.io' could not be verified:
  signer-not-found
  invalid

I suspect that it happens after the importer hits
"wasm-bindgen-webidl" and starts going circles. Maybe there's some
circullar dependencies going on, but I'm not sure. I'm attaching a
full log for convenience.

For additional info: I'm running Guix on Arch Linux. I've also
installed nss-certs package, exported all neeeded variables
(SSL_CERT_DIR, SSL_CERT_FILE and GIT_SSL_CAINFO) before running guix
import and also made sure nscd.service is running.

Regards,
Valentin Ignatev

crates_recursive_importer.log
Description: Text Data