bug#45174: ‘guix substitute’ doesn’t handle HTTP redirects

[Mark H Weaver]

Hi Julien,

Julien Lepiller <julien@lepiller.eu> writes:

> Here is a patch to fix that issue.  Since ci.guix.info now returns 200,
> it's difficult to test the patch.  [...]
[...]
> From f20e01f2a8df538519660772a7431b53d650d64f Mon Sep 17 00:00:00 2001
> From: Julien Lepiller <julien@lepiller.eu>
> Date: Tue, 12 Jan 2021 18:07:25 +0100
> Subject: [PATCH] substitute: Follow narinfo redirections.
>
> * guix/scripts/substitute.scm (fetch-narinfos): Follow redirections.
> ---
>  guix/scripts/substitute.scm | 38 +++++++++++++++++++++++++++----------
>  1 file changed, 28 insertions(+), 10 deletions(-)
>
> diff --git a/guix/scripts/substitute.scm b/guix/scripts/substitute.scm
> index e53de8c304..790168091e 100755
> --- a/guix/scripts/substitute.scm
> +++ b/guix/scripts/substitute.scm
> @@ -663,18 +663,36 @@ port to it, or, if connection failed, print a warning 
> and return #f.  Pass
[...]
> +        ((301 302 303 307 308)            ; redirect
> +         (let* ((uri (response-location response))
> +                (new-request (build-request
> +                               uri #:headers '((User-Agent . "GNU Guile")))))
> +           (if len
> +               (get-bytevector-n port len)
> +               (read-to-eof port))
> +           (append
> +             (http-multiple-get uri
> +                                handle-narinfo-response '()
> +                                (list new-request)
> +                                #:open-connection
> +                                open-connection-for-uri/cached
> +                                #:verify-certificate? #f)
> +             result)))

Granted, it's been almost six years since I first implemented proper
HTTP redirects for Guix, but as I vaguely recall the URI in the response
may be a relative URI or have some missing components, so in the general
case it must be interpreted relative to the previous URI in accordance
with RFC 3986 section 5.2.

A proper implementation should use 'resolve-uri-reference' from (guix
build download).  Here's the original commit that added that function,
and used it to fix HTTP redirection support in (guix http-client):

  
https://git.savannah.gnu.org/cgit/guix.git/commit/?id=04dec194d8e460831ec0695a944d9c7313affea2

Also, keep in mind that multiple redirects may occur, so a proper
implementation requires some kind of loop.  I haven't looked closely
enough at your code above to know whether that case is handled
correctly.  See the relevant code in (guix http-client) for hints.

Anyway, thanks for working on it!

     Regards,
       Mark