bug#46212: ci.guix.gnu.org narinfos with excessive NarSize

[Ludovic Courtès]

Hi there!

Christopher Baines <mail@cbaines.net> skribis:

> Guix gives the following error when it encounters one of these bad
> narinfos:
>
>   error: integer expected from stream

I get this while attempting to install flightgear from
12c17b46f1464db5591572754c814c845a2057ad.

It has the scary NarSize:

--8<---------------cut here---------------start------------->8---
$ wget -qO - https://ci.guix.gnu.org/k094mjy3m1cyh85vd27l2gn0w5ikscya.narinfo | 
head -9
StorePath: /gnu/store/k094mjy3m1cyh85vd27l2gn0w5ikscya-flightgear-2018.3.5
URL: nar/gzip/k094mjy3m1cyh85vd27l2gn0w5ikscya-flightgear-2018.3.5
Compression: gzip
FileSize: 1797450320
URL: nar/lzip/k094mjy3m1cyh85vd27l2gn0w5ikscya-flightgear-2018.3.5
Compression: lzip
FileSize: 1605734577
NarHash: sha256:0bwyhvqr7l5sk6fckymj41bivm6ws09aid8lg6lg0bmy513kn0aw
NarSize: 18446744072099352280
--8<---------------cut here---------------end--------------->8---

The nar was baked on March 17th:

--8<---------------cut here---------------start------------->8---
ludo@berlin ~$ ls -l 
/var/cache/guix/publish/lzip/k094mjy3m1cyh85vd27l2gn0w5ikscya-flightgear-2018.3.5.narinfo
-rw-r--r-- 2 guix-publish guix-publish 2232 Mar 17 22:20 
/var/cache/guix/publish/lzip/k094mjy3m1cyh85vd27l2gn0w5ikscya-flightgear-2018.3.5.narinfo
--8<---------------cut here---------------end--------------->8---

The nar size is indeed negative again:

--8<---------------cut here---------------start------------->8---
ludo@berlin ~$ sudo sqlite3 /var/guix/db/db.sqlite
SQLite version 3.28.0 2019-04-16 19:49:53
Enter ".help" for usage hints.
sqlite> select * from validpaths where 
path='/gnu/store/k094mjy3m1cyh85vd27l2gn0w5ikscya-flightgear-2018.3.5';
45484766|/gnu/store/k094mjy3m1cyh85vd27l2gn0w5ikscya-flightgear-2018.3.5|sha256:5c013b4728be2ef0a87914b5a812d0dcd41d5720b2fac99c99bad093f1869e2f|1615825221|/gnu/store/r995zx36fm4k4r1mwyy22mg2syjdc0fj-flightgear-2018.3.5.drv|-1610199336
--8<---------------cut here---------------end--------------->8---

Registration date is:

--8<---------------cut here---------------start------------->8---
scheme@(guile-user)> (date->string (time-utc->date (make-time time-utc 0 
1615825221) 3600))
$11 = "Mon Mar 15 17:20:21+0100 2021"
--8<---------------cut here---------------end--------------->8---

Right now berlin is running guix-1.2.0-13.a53f711, which AFAICS includes
the narsize bound checking added in 13a7d2a538b00aa0a8cf9b999f1a4ff3e5959af9.

This only ensures that narsize is positive.  Could it be that wrapping
happens in sqlite itself?  Or could it be that Cuirass itself uses an
older version of (guix store database)?

Ludo’.