The tested AppImages were not actually relocatable and would rely on items
being available on the environment’s store (apart from glibc).
* guix/scripts/pack.scm (wrapped-manifest): New function.
(guix-pack): Extract relocatable manifest to wrapped-manifest.
* tests/pack.scm: Use relocatable profiles in AppImage tests.
Fixes: <https://issues.guix.gnu.org/76850>
Change-Id: Ib3123054913fce903d215dc0629d806e9fceebc7
Reported-by: Reepca Russelstein <reepca@russelstein.xyz>
Signed-off-by: Vagrant Cascadian <vagrant@debian.org>
The runtime-fuse3 binary was renamed to runtime.
* gnu/packages/appimage.scm (appimage-type2-runtime):
Update to continuous-1.caf24f9.
* guix/scripts/pack.scm (self-contained-appimage):
[runtime-path]: Use new runtime name.
Change-Id: Ibbb1fcb6ca914764c37addb62c8234b49cc93bd5
Signed-off-by: Vagrant Cascadian <vagrant@debian.org>
Both (guix channel) and (guix git-authenticate) use similar procedures.
To refactor the one in (guix git-authenticate), move the procedure
to (guix openpgp).
* guix/channels.scm: Replace autoloaded import
openpgp-public-key-fingerprint with openpgp-fingerprint->bytevector.
(openpgp-fingerprint->bytevector):
Move function definition from here...
* guix/openpgp.scm (openpgp-fingerprint->bytevector): ...to here.
* guix/git-authenticate.scm (read-authorizations):
Use openpgp-fingerprint->bytevector.
* guix/scripts/git/authenticate.scm:
Avoid using the (guix channels) module.
* tests/git-authenticate.scm : Likewise.
Change-Id: Ifd20588fcfaab601990098bd8575ee985e87394a
Reviewed-by: Danny Milosavljevic <dannym@friendly-machines.com>
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>
Previously ‘--save-provenance’ would be silently ignored for ‘guix system
image’.
* guix/scripts/system.scm (image-with-provenance): New procedure.
(process-action): In ‘transform’, add case for ‘image?’, and emit a warning in
the default case.
Change-Id: I5020a4b3dacbe7a0820a3c4779b7d86a8133bd60
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #7485
Previously, when the version tag could not be cloned, ‘generate-git-source’
would return #f leading ‘guix style’ to crash with a type error. Now, a
warning about the Git error is printed and ‘guix style’ keeps going.
* guix/scripts/style.scm (transform-to-git-fetch): Wrap ‘match’ clause in
‘catch’ and return #f on ‘git-error’.
Change-Id: If66b1c5f8e0a44155b96f3c54bab7c58aae406f8
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* guix/import/utils.scm (tarball-url->git-repository-url): New procedure.
* guix/scripts/style.scm (url-fetch->git-fetch)[transform-source]: Add
‘repository-url’ parameter.
Use ‘tarball-url->git-repository-url’ when ‘home-page’ is not a Git URL.
(transform-to-git-fetch): Rename ‘home-page’ to ‘repository-url’.
* tests/import/utils.scm ("tarball-url->git-repository-url, guile"): New test.
* tests/style.scm ("url-fetch->git-fetch, mirror:// URL"): New test.
Change-Id: I4f8ca7c67a58f917d69380678b62c00962b0f9cd
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Fixesguix/guix#6989.
* guix/scripts/pack.scm (debian-archive): When creating a Debian package
for an armhf-linux machine match our architecture to the closest one of
Debian's supported architectures.
Change-Id: I596db1087c507e61cc31f0808ebd9e39b4956c49
This reverts commit b6a070d2a3, which patched
git-lfs so its hooks would refer to a 'sh' from the store, but this reference
was at risk of going stale since the hooks are installed and preserved outside
the store. The shebangs are now patched in the `git-fetch' procedure
directly.
* guix/scripts/perform-download.scm (perform-git-download): Expand comment.
* guix/git-download.scm (bash-package): New variable.
(git-fetch/in-band*): Add #:bash argument.
(git-fetch-builder): Add it to `inputs', so that it gets added to PATH.
* guix/build/git.scm (git-fetch): Substitute /bin/bash in the post-checkout
git-lfs hook shebang.
Fixes: https://codeberg.org/guix/guix/issues/5616
Reported-by: Simon Josefsson <simon@josefsson.org>
Change-Id: Ife81737705bef5d0a1edad307ed77a479af4609e
This changes the behaviour for the first one or few nars the substitute script
downloads, with uncompressed and zstd compressed nars prefered rather than
picking by file size.
* guix/scripts/substitute.scm: (%default-fast-decompression?): Change to #t.
* tests/substitute.scm ("substitute, preferred nar URL is 404, other is 200"):
Adjust test.
Change-Id: I89202f084cd6b9d506bcb3d46f75de690c6986b5
To be consistent with other procedures that make network requests.
* guix/substitutes.scm (download-nar): Add #:keep-alive? option.
* guix/scripts/substitute.scm (process-substitution/fallback)
(process-substitution): Call download-nar with #:keep-alive? #t.
Change-Id: I83b27d0c3a0916d058fbbbeb7aa77dbb8a742768
From the substitutes script. This makes it possible to use download-nar in
the the Guile guix-daemon.
* guix/scripts/substitute.scm (%fetch-timeout): Move down to where it's now
used.
(%random-state, with-timeout, catch-system-error, http-response-error?,
download-nar): Move to…
* guix/substitutes.scm: …here.
Change-Id: I8c09bf4b33cb5c6d042057d4d9adeb36c24c11dc
This is in preparation for moving the download-nar procedure out of the
script.
As well as calling open-connection-for-uri/cached, with-cached-connection adds
a single retry to the expression passed in, in the case of a exception that
suggests there's a problem with the cached connection. This is important
because download-nar/http-fetch doesn't check if a connection used for
multiple requests should be closed (because the servers set the relevant
response header).
To make download-nar more generic, have it take open-connection-for-uri as a
keyword argument, and replicate the with-cached-connection single retry by
closing the port in the case of a network error, and recalling
open-connection-for-uri. This will work fine in the case when connection
caching is not in use, as well as when open-connection-for-uri/cached is used,
since open-connection-for-uri/cached will open a new connection if the cached
port is closed.
* guix/scripts/substitute.scm (kind-and-args-exception?): Remove and inline
where necessary.
(call-with-cached-connection): Remove procedure.
(with-cached-connection): Remove syntax rule.
(http-response-error?): New procedure.
(download-nar): Add new #:open-connection-for-uri keyword argument and use it,
also replace with-cached-connection.
(process-substitution/fallback,process-substitution): Pass
#:open-connection-for-uri open-connection-for-uri/cached to download-nar.
Change-Id: I277b1d8dfef79aa1711755b10b9944da7c19157c
Plus remove http-get-error? from network-error? as http-get-error? doesn't
indicate a network error.
* guix/scripts/substitute.scm (process-substitution/fallback)
(process-substitution): Use http-get-error? with network-error?.
(system-error?, network-error?): Move from here…
* guix/http-client.scm: …to here, and also don't use http-get-error?.
Change-Id: I61ee9e5fbf90ebb76a34aa8b9ec8f5d74f8a3c54
As this moves download-nar in a direction where it could be used outside the
substitute script.
* guix/scripts/substitute.scm (download-nar): Return expected and actual
hashes and move status-port output to guix-substitute.
(process-substitution/fallback): Remove port argument, and move output to port
to guix-substitute.
(process-substitution): Return hashes from download-nar or
process-substitution/fallback, plus the narinfo.
(guix-substitute): Don't pass the reply-port in to process-substitution and
implement the messages to the reply-port here.
Change-Id: Icbddb9a47620b3520cdd2e8095f37a99824c1ce0
Pulling the logic up to the script makes this code more portable and not
reliant on setting a global variable.
* guix/scripts/substitute.scm (%prefer-fast-decompression?): Rename to…
(%default-fast-decompression?): this.
(call-with-cpu-usage-monitoring): Use multiple values to return the results
from the thunk as well as the cpu usage.
(display-narinfo-data): Update accordingly.
(download-nar): Add fast-decompression? as a keyword argument, remove
code to set! it and monitor the cpu-usage.
(process-substitution, process-substitution/fallback): Accept and pass through
fast-decompression? to download-nar.
(guix-substitute): Move the cpu usage monitoring and fast decompression
switching logic here.
Change-Id: I4e80b457b55bcda8c0ff4ee224dd94a55e1b24fb
Rather than just the port and response-content-length. I'm looking at using
the response headers within the substitute script to work out when to close
the connection.
* guix/http-client.scm (http-fetch): Return the response as the second value,
rather than the response-content-length.
* guix/build/download-nar.scm (download-nar): Adapt accordingly.
* guix/build/download.scm (url-fetch): Adapt accordingly.
* guix/scripts/substitute.scm (process-substitution): Adapt accordingly.
* guix/scripts/challenge.scm (call-with-nar): Adapt accordingly.
Change-Id: I490ecf7cef1f5ebbf1e6ed026f6a8fc9dacc56be
To reduce the codepaths in download-nar.
* guix/scripts/substitute.scm (with-timeout): Accept a #f duration and don't
set a timeout.
(download-nar): Remove the if for fetch-timeout.
Change-Id: I4e944a425a8612e96659dd84dd0e315012f080ab
GUIX_PROFILE should typically be unset, to prevent issues when sourcing
etc/profile of other profiles. So encourage it by showing it in the hint.
Followup of 50a2d73eac.
* guix/scripts/package.scm (display-search-path-hint): Add unset GUIX_PROFILE
to displayed hint.
Change-Id: Ie1564750017dde8bf896c79e463067699df709eb
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
Merges: #5118
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
GUIX_PROFILE should typically be unset, to prevent issues when sourcing
etc/profile of other profiles. So encourage it by showing it in the hint.
Followup of 50a2d73eac.
* guix/scripts/package.scm (display-search-path-hint): Add unset GUIX_PROFILE
to displayed hint.
Change-Id: Ie1564750017dde8bf896c79e463067699df709eb
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
Merges: #5118
The manual suggests running ‘guix archive --generate-key’ as root, but that
would lead to root-owned /etc/guix/signing-key.{pub,sec}, with the secret key
unreadable by the unprivileged guix-daemon. This fixes it.
Reported in guix/guix#4844.
* guix/scripts/archive.scm (generate-key-pair)[ensure-daemon-ownership]: New
procedure.
Use it for ‘%public-key-file’, ‘%private-key-file’, and their parent
directory.
Reported-by: Rutherther <rutherther@ditigal.xyz>
Change-Id: I7ae980bfd40078fb7ef27a193217b15f366d5d50
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #4958
Previously, when failing to load a signing key, ‘guix authenticate’ would
print a backtrace and exit with a non-zero code. That, in turn, would lead
the guix-daemon child process to crash with:
nix/libutil/serialise.cc:15: virtual nix::BufferedSink::~BufferedSink(): Assertion `!bufPos' failed.
This patch fixes it by reporting the error to the daemon as was intended.
* guix/scripts/authenticate.scm (guix-authenticate): Arrange to call
‘load-key-pair’ from within ‘with-reply’.
* tests/guix-authenticate.sh: Test it.
Fixes: guix/guix#4928
Reported-by: Rutherther <rutherther@ditigal.xyz>
Change-Id: I8654ad6fdfbe18c55e1e85647d0c49f408d0574a
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #4961
In case a user reconfigures to the same commit, do not
update cached checkout unnecessarily.
* guix/scripts/system/reconfigure.scm (channel-relations): Return early for
matching old and new commits.
Change-Id: Ia4b7300bbce40f7d809946dd3514715b74cd17f9
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
Fixes a regression introduced in d12c4452a4,
where ‘guix shell’, on a fresh installation, would attempt to create the
cached profile directory under /var/guix/profiles/per-user/$USER, which only
guix-daemon can do, on the user’s first connection.
* guix/scripts/shell.scm (options-with-caching): Remove ‘mkdir-p’ call for
ROOT’s parent directory. Add ‘create-gc-root-directory?’ key to the result.
* guix/scripts/environment.scm (guix-environment*): Honor
‘create-gc-root-directory?’ key.
Fixes: guix/guix#126
Reported-by: Maxim Cournoyer <maxim@guixotic.coop>
Change-Id: I782461c80c254467108c6b8d676d269866795746
Fixes#2932.
Pass graft? to cache-key functions to not forget about it again,
like with the (%graft?) parameter.
* guix/scripts/shell.scm
(profile-file-cache-key): Accept graft? argument instead of %graft? parameter.
(profile-spec-cache-key): Likewise.
(profile-cached-gc-root): Pass graft? argument from opts to
profile-file-cache-key and profile-spec-cache-key.
Change-Id: I9654bb2c59864d39ba7070ea0f19d922513ef024
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Mounting file systems with ‘noatime’ is common. Thus, avoid relying on the
atime.
* guix/scripts/publish.scm (render-narinfo/cached): Add ‘utime’ call on cache
hit. Use ‘stat’ instead of ‘file-exists?’.
(bake-narinfo+nar): Update comment.
Change-Id: Id8c68d3b793922fdadca8cbd02b50368b418bb67
Relying on atime was fine even on ‘noatime’ file systems because the atime was
explicitly updated. However, on file systems with atime enabled, cache items
were potentially retained for too long since scanning the cache directory
could update atimes.
* guix/scripts/shell.scm (options-with-caching): In ‘utime’ call, change both
the mtime and the atime.
(guix-shell)[entry-expiration]: Use ‘file-expiration-time’ with ‘stat:mtime’.
Change-Id: Ibe2aedae41a1018a95c2efe7f2dcf08bd1caae2a
This code was added in 2018 (commit 795d430d90)
to move profile generations created before that from ~/.config/guix to
/var/guix/profiles. It has long become useless.
* guix/scripts/pull.scm (migrate-generations): Remove.
(ensure-default-profile): Remove call to ‘migrate-generations’.
Change-Id: I43d3860995be300a065814db6c0482514035bda9
The `file->bytevector' new procedure uses a memory mapped bytevector, so
parsing the ELF file reads only the sections needed, not the whole file.
* guix/scripts/pack.scm (wrapped-package): Use file->bytevector.
* guix/build/gremlin.scm (file-dynamic-info): Likewise.
(validate-needed-in-runpath): Likewise.
(strip-runpath): Likewise, and write to bytevector directly, avoiding a port.
(set-file-runpath): Likewise.
* tests/gremlin.scm (read-elf): Delete procedure.
("elf-dynamic-info-needed, executable"): Use file-dynamic-info.
("strip-runpath"): Likewise.
("elf-dynamic-info-soname"): Likewise.
guix/build/debug-link.scm (set-debuglink-crc): Use file->bytevector.
* tests/debug-link.scm (read-elf): Delete procedure.
("elf-debuglink"): Rename to...
("elf-debuglink, no .gnu_debuglink section"): ... this.
("elf-debuglink", "set-debuglink-crc"): Use external store, and adjust to use
file->bytevector.
* gnu/packages/gnuzilla.scm (icecat-minimal) [#:phases]
{build-sandbox-whitelist}: Use `file-runpath'.
* gnu/packages/librewolf.scm (librewolf): Likewise.
Fixes: <https://issues.guix.gnu.org/59365>
Fixes: #1262
Change-Id: I43b77ed0cdc38994ea89d3d401e0d136aa6b187a
This is a followup to 95731b4ef1.
* gnu/services/herd.scm (load-services/safe): Remove.
* guix/scripts/system/reconfigure.scm (upgrade-services-program): Use
‘load-services’.
Change-Id: Ie5ab99e69e2d7c1934fddd37794c07e6e07489a3
In the case of the rootless daemon, perform-download runs as the daemon user.
There are files - such as /etc/guix/signing-key.sec - that guix-daemon can
read but that it is essential that ordinary users cannot.
Currently url-fetch can't access raw filenames, and it doesn't include a case
for "file://" urls. 'git-fetch-with-fallback' can fetch from "file://" urls,
but it requires that the specified url is a valid git repository.
To be on the safe side, and to insulate against any changes to what url-fetch
and git support, explicitly disallow raw filenames and "file://" urls.
* guix/scripts/perform-download.scm (assert-non-local-urls): new procedure.
(perform-download, perform-git-download): use it.
Change-Id: Ibf2a91e696246eccb89c2423fcbcabb2131d3be5
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Fixes <https://issues.guix.gnu.org/74832>.
After update to guile-ssh 0.18.0, options passed to the `make-session'
procedure now take precedence over the configuration file. In few places we
however had code like `(or port 22)' leading to (in absence of alternative
port being specified) always using port 22, ignoring the configuration file.
Due to that for example following command fails:
guix copy hello --to=name
Name is reachable, but ssh server listens on port 2222. That is correctly
configured in ~/.ssh/config, and the invocation used to succeed until the
upgrade. However now it tries to connect to port 22 (since port was not
specified). While setting the port on the command line *is* possible, it is
not exactly ergonomic.
Since guile-ssh (well, libssh) defaults to 22 if not told otherwise, we can
just always pass the port, and #f will use the port from ~/.ssh/config or, iff
none is set, 22.
I went through the repository and adjusted all places where it seemed
appropriate. In particular, these places were left alone:
gnu/machine/digital-ocean.scm: The droplet is created with root user and the
expected key, so forcing them to those values seems correct.
gnu/machine/ssh.scm: For deployments reproducibility is favored over
convenience, and user can pass #f to explicitly request using value the
~/.ssh/config.
* guix/scripts/copy.scm (send-to-remote-host): Always pass the port to
open-ssh-session.
(retrieve-from-remote-host): Same.
* guix/scripts/offload.scm (open-ssh-session): Pass #f as #:config. Skips
reading the configuration file and is nicer.
* guix/ssh.scm (open-ssh-session): Drop explicit parsing of the configuration
since it is parsed by default. Report actual port used in the error message.
* guix/store/ssh.scm (connect-to-daemon): Always pass the port part of the
uri, even when #f.
Change-Id: I5fdf20f36509a9a0ef138ce72c7198f688eea494
Reported-by: Dariqq <dariqq@posteo.net>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* guix/scripts/refresh.scm (options->update-specs): Always honor
--target-version.
* doc/guix.texi (Invoking guix refresh): Add an example showing how this can
be useful.
Change-Id: I55f98c88f4b583f65dd85a6d3573f9bc87a1dead
Fixesguix/guix#2410.
Until now, ‘guix shell’ and ‘guix time-machine’ would store GC roots under
~/.cache/guix. However, this directory is unreadable to guix-daemon when it’s
running without root privileges. This commit changes ‘guix shell’ and ‘guix
time-machine’ so they store GC roots under /var/guix/profiles/per-user/$USER,
in a world-readable directory.
An added benefit is that, in cluster setups, user homes no longer need to be
mounted on the head node for GC to work (assuming ‘guix build -r’ and similar
are not used).
* guix/inferior.scm (%inferior-cache-directory): Change default value to be
under ‘%profile-directory’.
(%legacy-inferior-cache-directory): New variable.
(cached-channel-instance): Add ‘maybe-remove-expired-cache-entries’ call.
* guix/scripts/environment.scm (launch-environment/container)[nesting-mappings]:
Add /inferiors and /profiles sub-directories of ‘%profile-directory’. Call
‘mkdir-p’ for these two directories.
* guix/scripts/shell.scm (%profile-cache-directory): Change default value to
be under ‘%profile-directory’.
(%legacy-cache-directory): New variable.
(guix-shell): Add call to ‘maybe-remove-expired-cache-entries’.
Change-Id: Ie7d6c16a55b35c7beb18078c967d6fc902bf68d0
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Fixesguix/guix#2450.
This reverts commit b5745a327e, which introduced
discrepancies in how substitutes are served; in particular, narinfos of
non-substitutable items would still be served, and likewise for narinfos and
nars of dependents of non-substitutable items.
Fixesguix/guix#1901.
Previously, ‘guix gc --list-busy’ (which is invoked by ‘guix-daemon’) would
open a connection to the daemon, which in turn attempts to create
/var/guix/profiles/per-user/$USER. However, when ‘guix-daemon‘ is running as
an unprivileged user, creating that directory fails with EPERM. Because of
this, garbage collection would always fail when running the unprivileged
daemon on Guix System.
* guix/scripts/gc.scm (guix-gc): Remove upfront call to ‘open-connection’.
Instead, use ‘with-store’ only for operations that require it.
Change-Id: I1fbfd97cf7ba9e3087f7287b4776ea2f6623400d
This reverts commit a7db92d9b3, this time with
the more careful command, to avoid a world rebuild:
grep -rl --exclude-dir=build --exclude-dir=patches --exclude=ld-wrapper.in \
--exclude=sitecustomize.py --exclude=guix-emacs.el maxim.cournoyer@gmail.com |
xargs sed -i 's/maxim.cournoyer@gmail.com/maxim@guixotic.coop/g'
Change-Id: I0871f5cf9ace79e34e78e24154d0da6ea95a3a91
The change was automated via:
git grep -l maxim.cournoyer@gmail.com |
xargs sed -i 's/maxim.cournoyer@gmail.com/maxim@guixotic.coop/g'
* .mailmap: New entry.
Change-Id: Iaa88b1e51c94159c49138fb43910badb990eb169
* guix/scripts/home.scm (spawn-home-container): Add ‘options’ field to
the /run/user/$UID and ‘home-directory’ file systems.
Change-Id: Ic6d987fe186f9c49718f15c71867953a20f2fb68
Noé Lopez