[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: git-fetch without a hash
From: |
Ludovic Courtès |
Subject: |
Re: git-fetch without a hash |
Date: |
Mon, 09 Jan 2023 18:13:31 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) |
Hi,
Ludovic Courtès <ludo@gnu.org> skribis:
> scheme@(guile-user)> ,lower (origin
> (method url-fetch)
> (uri "mirror://gnu/hello/hello-2.12.1.tar.gz")
> (sha256 #f))
> $6 = #<derivation
> /gnu/store/lz34lhyxhq5wxj87fnd465hmwbhv17bn-hello-2.12.1.tar.gz.drv =>
> /gnu/store/xfc7gsn10j09bi89ldbpfbppfkcldfy9-hello-2.12.1.tar.gz 7f3ff487c000>
> scheme@(guile-user)> (derivation-outputs $6)
> $7 = (("out" . #<<derivation-output> path:
> "/gnu/store/xfc7gsn10j09bi89ldbpfbppfkcldfy9-hello-2.12.1.tar.gz" hash-algo:
> sha256 hash: #f recursive?: #f>))
> scheme@(guile-user)> (fixed-output-derivation? $6)
> $8 = #f
>
> As it turns out, guix-daemon turns off the chroot for all built-in
> builders, fixed-output or not; quoth ‘build.cc’:
>
> /* Note: built-in builders are *not* running in a chroot environment so
> that we can easily implement them in Guile without having it as a
> derivation input (they are running under a separate build user,
> though). */
> useChroot = settings.useChroot && !isBuiltin(drv);
>
> I was actually surprised to see this, this wasn’t really intended. The
> good news is that this is safe AFAICS: there’s only one built-in builder
> to date, and that’s “download”.
After investigating, I found that ‘guix perform-download’ already has a
check in place:
(unless (and algo hash)
(leave (G_ "~a is not a fixed-output derivation~%")
(derivation-file-name drv)))
The check wasn’t working because ‘hash’ was #vu8() instead of #f. This
is fixed in 5d24e57a611b43ff68700379338b899f62d198cc.
Once we update the ‘guix’ package, the daemon will no longer accept
‘url-fetch’ downloads with hash = #f.
Thanks again for reporting this oddity!
Ludo’.