bug#33603: Invalid hash for NSS-Certs

[Ludovic Courtès]

Hi!

Maxim Cournoyer <address@hidden> skribis:

> Ludovic Courtès <address@hidden> writes:
> [...]
>> The wget commands above still give me the correct result, with hash
>> 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla.
>>
>> Are you running Guix on a foreign distro?  If so, could it be that
>> guix-daemon is effectively running in the C locale?
>
> This is a good guess, and we've seen this very issue before. I am using
> GuixSD. I had to use --fallback to work around it.
>
> I've digged a little bit:
>
> $ wget -q -O - 
> https://mirror.hydra.gnu.org/nar/gzip/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
>  | gunzip | guix archive -x 
> /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra
>
> $ guix hash -r /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra
> 101v69xp1qzw9v6pgmbhw7gfdaic8vvs4v5l567lx7f2mjp25rla
>
> $ guix build nss-certs
> /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
>
> $ guix hash -r /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
> 08ziz714diyfq2klxy1nc0nhr5wa2vd356n9vizlq913a7an9a9s
>
> $ diff -r /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra 
> /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39
> Only in 
> /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra/etc/ssl/certs:
>  
> AC_Raíz_Certicámara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem
> Only in 
> /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39/etc/ssl/certs: 
> AC_Ra?z_Certic?mara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem
> Only in 
> /tmp/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39_from-hydra/etc/ssl/certs:
>  NetLock_Arany_=Class_Gold=_Főtanúsítvány:2.6.73.65.44.228.0.16.pem
> Only in
> /gnu/store/xbj4fhad0lnz0ziflwi90gyqbls8ains-nss-certs-3.39/etc/ssl/certs:
> NetLock_Arany_=Class_Gold=_F?tan?s?tv?ny:2.6.73.65.44.228.0.16.pem
>
> It's a rather old install (late 2016 -- but kept up-to-date, of course
> :-)) so there might be remnants from the past?  How could I verify in
> which locale the guix-daemon is running?

You could check /proc/$(pidof guix-daemon)/environ for variables like
‘LC_ALL’.  And of course, you can see if ‘guix substitute’ emits the
infamous “can’t install locale” message.  :-)

Regardless, I think ‘guix substitute’ should ideally be
locale-insensitive, or it should error out rather than produce files
with the wrong names.

HTH,
Ludo’.