Report forwarded
to bug-guix@gnu.org: bug#55399; Package guix.
(Fri, 13 May 2022 15:22:01 GMT) (full text, mbox, link).
Acknowledgement sent
to André Batista <nandre@riseup.net>:
New bug report received and forwarded. Copy sent to bug-guix@gnu.org.
(Fri, 13 May 2022 15:22:01 GMT) (full text, mbox, link).
Subject: guix system reconfigure fails on channel validation
Date: Fri, 13 May 2022 12:21:27 -0300
Hello Guix!
Recently, I've not been able to reconfigure some of my guix systems
because guix fails to forward validate the commits in between the
current system deployment and the newer one. This appears to be
related to the new libgit2 version 1.4.3[1][2], which addressed CVE
2022-24765, since there was no change to the related guix routines
on the time lapse since the last deploy.
This is the error I'm getting:
$ sudo guix system --fallback -c 3 -M 3 reconfigure myconfig.scm
Backtrace:
19 (primitive-load "/home/user/.config/guix/current/bin/g?")
In guix/ui.scm:
2230:7 18 (run-guix . _)
2193:10 17 (run-guix-command _ . _)
In ice-9/boot-9.scm:
1752:10 16 (with-exception-handler _ _ #:unwind? _ # _)
In guix/status.scm:
829:3 15 (_)
809:4 14 (call-with-status-report _ _)
In guix/scripts/system.scm:
1253:4 13 (_)
In ice-9/boot-9.scm:
1752:10 12 (with-exception-handler _ _ #:unwind? _ # _)
In guix/store.scm:
658:37 11 (thunk)
1320:8 10 (call-with-build-handler #<procedure b445f18 at guix/u?> ?)
2129:25 9 (run-with-store #<store-connection 256.99 b0934d8> _ # _ ?)
In guix/scripts/system.scm:
1277:15 8 (_ _)
819:5 7 (perform-action reconfigure #<<image> name: #f format:?> ?)
In guix/scripts/system/reconfigure.scm:
345:3 6 (check-forward-update _ #:current-channels _)
In srfi/srfi-1.scm:
691:23 5 (filter-map #<procedure ba4c460 at guix/scripts/syst?> . #)
In guix/scripts/system/reconfigure.scm:
352:37 4 (_ #<<channel> name: guix url: "/src/guix.git" branch: ?>)
In guix/git.scm:
469:7 3 (update-cached-checkout _ #:ref _ #:recursive? _ # _ # _ ?)
In git/bindings.scm:
77:2 2 (raise-git-error _)
In ice-9/boot-9.scm:
1685:16 1 (raise-exception _ #:continuable? _)
1685:16 0 (raise-exception _ #:continuable? _)
ice-9/boot-9.scm:1685:16: In procedure raise-exception:
Git error: repository path '/src/guix.git/' is not owned by current user
-----
And these are the commits being compared:
$ guix system describe
Generation 214 May 06 2022 22:47:43 (current)
file name: /var/guix/profiles/system-214-link
canonical file name: /gnu/store/b0wrzz8sxqi9hywpqz29cm73l9adxjy9-system
label: GNU with Linux-Libre-Atom 5.17.5
bootloader: grub
root device: label: "rootfs"
kernel: /gnu/store/xmdskyk85sypr4wgf5iwg5iid08l4aiq-linux-libre-atom-5.17.5/bzImage
channels:
guix:
repository URL: /src/guix.git
branch: master
commit: ee70ed5bf50e781a6a43985211aa763e28db62b9
configuration file: /gnu/store/g653hksfz0iwnbpynaq2mx4nv7ayb7r7-configuration.scm
$ guix describe
Generation 200 May 12 2022 13:48:01 (current)
guix a1cb645
repository URL: /src/guix.git
branch: master
commit: a1cb645d83d085382eaf64f4c097642aa47c297a
Any thoughts?
1. https://github.com/libgit2/libgit2/blob/v1.4.3/docs/changelog.md
2. https://github.com/libgit2/libgit2/commit/0cc4a70db0942f65528f4877be14a6a987fe3c64
3. https://github.blog/2022-04-12-git-security-vulnerability-announced/
Information forwarded
to bug-guix@gnu.org: bug#55399; Package guix.
(Fri, 13 May 2022 15:27:01 GMT) (full text, mbox, link).
André Batista schreef op vr 13-05-2022 om 12:21 [-0300]:
> Any thoughts?
For now, let 'guile-git' use the libgit2-1.3 variant, look into
relaxing the ‘is owned by’ check later?
Greetings,
Maxime
Hi Maxime!
sex 13 mai 2022 às 17:28:29 (1652473709), maximedevos@telenet.be enviou:
> André Batista schreef op vr 13-05-2022 om 12:21 [-0300]:
> > Any thoughts?
>
> According to
> <https://github.com/libgit2/libgit2/pull/6267/commits/574b5ee7bb112987443916cdedcfc8e274121e9d>,
> the ownership check can be relaxed by setting an option. The guile-
> git library would need to be adjusted to support the option though.
Thanks for your pointers. I've only had a substitute* hammer and this
certainly seemed like a loose nail, so I've hammered my way through.
The patch bellow addresses the issue on guix side only and it was
applied/tested locally before b6bfe9ea6a1b19159455b34f1af4ac00ef9b94ab
So this later commit would need to be reverted, otherwise guix will
not use the new libgit2 v1.4.3 anyway.
Anyway, the proper think to do is to update guile-git, so I'll be
opening an issue there.
Happy hacking!
Cc: 55399@debbugs.gnu.org, Maxime Devos <maximedevos@telenet.be>
Subject: Re: bug#55399: guix system reconfigure fails on channel validation
Date: Mon, 23 May 2022 16:18:52 +0200
Hi André,
André Batista <nandre@riseup.net> skribis:
> Anyway, the proper think to do is to update guile-git, so I'll be
> opening an issue there.
Yes please! You pretty much already have the code, so we could put
together a new Guile-Git release instead of carrying these modifications
in Guix proper.
(For now commit b6bfe9ea6a1b19159455b34f1af4ac00ef9b94ab changes
Guile-Git in Guix to depend on libgit2 1.3 as a workaround.)
Thanks!
Ludo’.
Changed bug title to 'libgit2 1.4.3 directory owner validation breaks Guix' from 'guix system reconfigure fails on channel validation'
Request was from Ludovic Courtès <ludo@gnu.org>
to control@debbugs.gnu.org.
(Mon, 23 May 2022 14:21:02 GMT) (full text, mbox, link).
Severity set to 'important' from 'normal'
Request was from Ludovic Courtès <ludo@gnu.org>
to control@debbugs.gnu.org.
(Mon, 23 May 2022 14:21:02 GMT) (full text, mbox, link).
Information forwarded
to bug-guix@gnu.org: bug#55399; Package guix.
(Tue, 24 May 2022 01:45:01 GMT) (full text, mbox, link).
Cc: 55399@debbugs.gnu.org, Maxime Devos <maximedevos@telenet.be>
Subject: Re: bug#55399: guix system reconfigure fails on channel validation
Date: Mon, 23 May 2022 22:44:23 -0300
Hi!
seg 23 mai 2022 às 16:18:52 (1653333532), ludo@gnu.org enviou:
> Yes please! You pretty much already have the code, so we could put
> together a new Guile-Git release instead of carrying these modifications
> in Guix proper.
Done! Issue 26.
https://gitlab.com/guile-git/guile-git/-/issues/26
Information forwarded
to bug-guix@gnu.org: bug#55399; Package guix.
(Tue, 24 May 2022 23:45:02 GMT) (full text, mbox, link).
Hi again,
seg 23 mai 2022 às 16:18:52 (1653333532), ludo@gnu.org enviou:
> ...
> (For now commit b6bfe9ea6a1b19159455b34f1af4ac00ef9b94ab changes
> Guile-Git in Guix to depend on libgit2 1.3 as a workaround.)
After upgrading guile-git, the attached patches disables owner
validation and reverts the above commit which made Guix's guile-git
depend on libgit2 1.3 instead of latest.
Cheers!
Oops, the test I did in the second test is bogus (I didn't test as root).
However, it appears that owner validation is properly disabled:
[inside the pulled guix]
> scheme@(guix-user)> ,m (guix git)
> scheme@(guix git)> (owner-validation?) --> #true
> scheme@(guix git)> (with-libgit2 (owner-validation?)) --> #false
Greetings,
Maxime.
Added indication that bug 55399 blocks53144
Request was from Maxime Devos <maximedevos@telenet.be>
to control@debbugs.gnu.org.
(Sun, 30 Oct 2022 15:45:02 GMT) (full text, mbox, link).
Information forwarded
to bug-guix@gnu.org: bug#55399; Package guix.
(Fri, 03 Feb 2023 03:50:01 GMT) (full text, mbox, link).
Cc: Maxime Devos <maximedevos@telenet.be>, 55399@debbugs.gnu.org
Subject: Re: bug#55399: guix system reconfigure fails on channel validation
Date: Fri, 3 Feb 2023 00:48:43 -0300
Hello,
ter 24 mai 2022 às 20:44:13 (1653435853), nandre@riseup.net enviou:
> seg 23 mai 2022 às 16:18:52 (1653333532), ludo@gnu.org enviou:
> > (For now commit b6bfe9ea6a1b19159455b34f1af4ac00ef9b94ab changes
> > Guile-Git in Guix to depend on libgit2 1.3 as a workaround.)
>
> After upgrading guile-git, the attached patches disables owner
> validation and reverts the above commit which made Guix's guile-git
> depend on libgit2 1.3 instead of latest.
#61246 has an alternative solution to this issue. Newer libgit2
versions check for safe.directory configuration entries on user's
global scope. This means that instead of disabling owner validation
in guix code itself, users can exempt directories of their own
choosing. This is IMO a better solution and so the patches provided
here should be disregarded.
However, since libgit2 seems to have changed its API elsewhere after
1.3.x, I've avoided messing with guile-git inputs this time and so
it still depends on libgit2-1.3.
IMO, instead of upgrading libgit2 dependency and risk breaking
guile-git in unknown ways, we should work on revising guile-git's
conformance to latter libgit2 versions (it's currently on 1.5.1).
Meaning not trying to apply the patches Maxime provided, but
working upstream.
WDYT?
Cheers!
Debbugs is free software and licensed under the terms of the
GNU Public License version 2. The current version can be
obtained from https://bugs.debian.org/debbugs-source/.