bug#58149: guix pull error

[zimoun]

Hi Bengt,

On ven., 07 oct. 2022 at 04:40, bokr@bokr.com wrote:
> On +2022-10-04 12:11:52 +0200, Ludovic Courtès wrote:
>> Matthieu Haefele <matthieu.haefele@cnrs.fr> skribis:

>> > Starting download of 
>> > /gnu/store/f2j6pi0d18pbz35ypflp61wzhbfcr8dp-linux-libre-4.14.67-gnu.tar.xz
>> > From 
>> > https://linux-libre.fsfla.org/pub/linux-libre/releases/4.14.67-gnu/linux-libre-4.14.67-gnu.tar.xz...
>> > download failed 
>> > "https://linux-libre.fsfla.org/pub/linux-libre/releases/4.14.67-gnu/linux-libre-4.14.67-gnu.tar.xz";
>> >  404 "Not Found"
>> 
>> [...]
>> 
>> > Starting download of 
>> > /gnu/store/f2j6pi0d18pbz35ypflp61wzhbfcr8dp-linux-libre-4.14.67-gnu.tar.xz
>> > From 
>> > https://mirror.hydra.gnu.org/file/linux-libre-4.14.67-gnu.tar.xz/sha256/050zvdxjy6sc64q75pr1gxsmh49chwav2pwxz8xlif39bvahnrpg...
>> > In procedure connect: Network is unreachable

>>   wget -O linux-libre-4.14.67-gnu.tar.xz \
>>        
>> https://ci.guix.gnu.org/file/linux-libre-4.14.67-gnu.tar.xz/sha256/050zvdxjy6sc64q75pr1gxsmh49chwav2pwxz8xlif39bvahnrpg
>>   guix download file://$PWD/linux-libre-4.14.67-gnu.tar.xz

> --8<---------------cut here---------------start------------->8---
> $ wget -q -O- 
> https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc|egrep 
> 4\\.14\\.67
> 93b4ea4816a8a73e4ba2d9c26dc622035b1b504010f1048c0455a190a653166e  
> ChangeLog-4.14.67
> a53d3a3b5877e1847fb34ecb75aabce2a1bf3cc0ee7236cf2aef02f0ecf83433  
> linux-4.14.67.tar.gz
> 3f4b056dc27233a78f7a4a35ed6fdcfd0a9680ec40b611a898bb6c8b905070ba  
> linux-4.14.67.tar.xz
> 42c7ff27d7cefbf0b4e313c757db1f2cfa2d65fa22cbe908c24aafafc995bd5f  
> patch-4.14.67.xz
> --8<---------------cut here---------------end--------------->8---

> --8<---------------cut here---------------start------------->8---
> $ time wget -q 
> https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/linux-4.14.67.tar.xz
>
> real    0m47.015s
> user    0m2.381s
> sys     0m3.720s
> $ sha256sum linux-4.14.67.tar.xz 
> 3f4b056dc27233a78f7a4a35ed6fdcfd0a9680ec40b611a898bb6c8b905070ba  
> linux-4.14.67.tar.xz
> --8<---------------cut here---------------end--------------->8---

I miss what you are suggesting.  Back on 2018, Guix relied on the kernel
distributed by linux-libre.fsfla.org.  Then they dropped the revision of
that version.

Note that at this time (2018), using the wayback time-machine [1], many
signatures were provided.  Then, once included in Guix by commit
fabe2c73548e88004b01f5218d1110141a2114d5, it reads,

--8<---------------cut here---------------start------------->8---
-(define %linux-libre-4.14-version "4.14.66")
-(define %linux-libre-4.14-hash 
"1sf18m6xjyg535yviz3yjbislf57s180y67z7mzbcl5pq9352bg9")
+(define %linux-libre-4.14-version "4.14.67")
+(define %linux-libre-4.14-hash 
"050zvdxjy6sc64q75pr1gxsmh49chwav2pwxz8xlif39bvahnrpg")
--8<---------------cut here---------------end--------------->8---

Therefore, you trusted the author of that commit (here Mark H Weaver).


Well, back to today. :-) Thing changed since 2018.  The Linux kernel is
special since it needs some deblob.  Even, a special origin is done for
that purpose named ’computed-origin’.

If you consider the current 4.14 series; revision 295.  For instance,

--8<---------------cut here---------------start------------->8---
$ wget -q 
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/linux-4.14.295.tar.xz
$ wget -q -O- 
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc|egrep 
4\\.14\\.295
eb77cae3fadc31f3b44ce3806c9492be1116e4b76ad82ca574c7da22bd78b50c  
ChangeLog-4.14.295
fc96f9a1a6f8671d034cc8c8e885bb89a52ba38e2ebaba36e9c83e3761ef1f13  
linux-4.14.295.tar.gz
62ccb9ba94a7da5115bc923eebf8dffee9229801da02be87d90ae68ab9a76a6b  
linux-4.14.295.tar.xz
941c34f4a5c438bbb1b0ab5ee84b8075acf9c4d3843697259e980def08c6a839  
patch-4.14.295.xz
$ sha256sum linux-4.14.295.tar.xz
62ccb9ba94a7da5115bc923eebf8dffee9229801da02be87d90ae68ab9a76a6b  
linux-4.14.295.tar.xz
--8<---------------cut here---------------end--------------->8---

--8<---------------cut here---------------start------------->8---
$ guix hash -S none -H sha256 -f hex linux-4.14.295.tar.xz
62ccb9ba94a7da5115bc923eebf8dffee9229801da02be87d90ae68ab9a76a6b

$ guix hash -S none -H sha256 -f nix-base32 linux-4.14.295.tar.xz
0svalywqmrhav63vw0ns06c25sgyvzwfngljpham3nm7jjxbkk32
--8<---------------cut here---------------end--------------->8---

and then you can compare this hash with the one in Guix source [2].

And you can do the same with the deblob scripts.

1: 
<https://web.archive.org/web/20190919181404/http://linux-libre.fsfla.org/pub/linux-libre/releases/4.14.67-gnu/>
2: 
<https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages/linux.scm?id=759d365cd2485a46a66ed02819f9770677040137#n446>


Cheers,
simon