GNU bug report logs

#76660 Downgrade prevention triggers erroneously with 'guix pull'

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Reply or subscribe to this bug. View this bug as an mbox, status mbox, or maintainer mbox

Report forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sat, 01 Mar 2025 16:38:03 GMT) (full text, mbox, link).


Acknowledgement sent to Jack Hill <jackhill@jackhill.us>:
New bug report received and forwarded. Copy sent to bug-guix@gnu.org. (Sat, 01 Mar 2025 16:38:03 GMT) (full text, mbox, link).


Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Jack Hill <jackhill@jackhill.us>
To: bug-guix@gnu.org
Subject: current guix pull doesn't authenticate
Date: Sat, 1 Mar 2025 11:37:40 -0500 (EST)
jackhill@lissome ~$ guix describe
Generation 159  Feb 27 2025 22:08:27    (current)
  guix f13f076
    repository URL: https://git.savannah.gnu.org/git/guix.git
    branch: master
    commit: f13f0769688493271f43f31a016957355dbecb30
jackhill@lissome ~$ guix pull
Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...
guix pull: error: aborting update of channel 'guix' to commit 6ca7b07a251739dfaefa639e74c01e3013c9454c, which is not a descendant of f13f0769688493271f43f31a016957355dbecb30
hint: This could indicate that the channel has been tampered with and is trying to force a
roll-back, preventing you from getting the latest updates.  If you think this is not the
case, explicitly allow non-forward updates.

I don't have reason to believe the channel needs to be rolled back, I 
assume something is wrong with the savannah copy of the repo, but don't 
know. Can someone confirm?

Thanks!
Jack




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sat, 01 Mar 2025 21:42:02 GMT) (full text, mbox, link).


Message #8 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Tomas Volf <~@wolfsden.cz>
To: Jack Hill <jackhill@jackhill.us>
Cc: 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sat, 01 Mar 2025 22:41:16 +0100
[Message part 1 (text/plain, inline)]
Jack Hill <jackhill@jackhill.us> writes:

> jackhill@lissome ~$ guix describe
> Generation 159  Feb 27 2025 22:08:27    (current)
>   guix f13f076
>     repository URL: https://git.savannah.gnu.org/git/guix.git
>     branch: master
>     commit: f13f0769688493271f43f31a016957355dbecb30
> jackhill@lissome ~$ guix pull
> Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...
> guix pull: error: aborting update of channel 'guix' to commit 6ca7b07a251739dfaefa639e74c01e3013c9454c, which is not a descendant of f13f0769688493271f43f31a016957355dbecb30
> hint: This could indicate that the channel has been tampered with and is trying to force a
> roll-back, preventing you from getting the latest updates.  If you think this is not the
> case, explicitly allow non-forward updates.
>
> I don't have reason to believe the channel needs to be rolled back, I assume
> something is wrong with the savannah copy of the repo, but don't know. Can
> someone confirm?

Can confirm.

--8<---------------cut here---------------start------------->8---
/tmp/test$ /tmp/test/profile/bin/guix describe
Generation 1	Mar 01 2025 21:04:08	(current)
  guix f13f076
    repository URL: https://git.savannah.gnu.org/git/guix.git
    commit: f13f0769688493271f43f31a016957355dbecb30
/tmp/test$ /tmp/test/profile/bin/guix pull -q --commit=6ca7b07a251739dfaefa639e74c01e3013c9454c --profile=/tmp/test/profile
Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...
guix pull: error: aborting update of channel 'guix' to commit 6ca7b07a251739dfaefa639e74c01e3013c9454c, which is not a descendant of f13f0769688493271f43f31a016957355dbecb30
hint: Use `--allow-downgrades' to force this downgrade.

--8<---------------cut here---------------end--------------->8---

There is nothing wrong with the repository, and the commit is a
descendant:

--8<---------------cut here---------------start------------->8---
$ git merge-base --is-ancestor f13f0769688493271f43f31a016957355dbecb30 6ca7b07a251739dfaefa639e74c01e3013c9454c
$ echo $?
0
--8<---------------cut here---------------end--------------->8---

Given that f13f0769688493271f43f31a016957355dbecb30 has fairly large
commit message, maybe the known bugs in how we are using guile-git
finally caught up with us.

I guess you can use the --allow-downgrades to by-pass the check after
you manually verify in the git repository the relation of the commits.
Sucks, but should allow you to pull.

Have a nice day,
Tomas
-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 02 Mar 2025 06:26:02 GMT) (full text, mbox, link).


Message #11 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: 45mg <45mg.writes@gmail.com>
To: Tomas Volf <~@wolfsden.cz>, Jack Hill <jackhill@jackhill.us>
Cc: 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sun, 02 Mar 2025 06:24:55 +0000
Tomas Volf <~@wolfsden.cz> writes:

> Jack Hill <jackhill@jackhill.us> writes:
[...]
>> jackhill@lissome ~$ guix pull
>> Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...
>> guix pull: error: aborting update of channel 'guix' to commit 6ca7b07a251739dfaefa639e74c01e3013c9454c, which is not a descendant of f13f0769688493271f43f31a016957355dbecb30
>> hint: This could indicate that the channel has been tampered with and is trying to force a
>> roll-back, preventing you from getting the latest updates.  If you think this is not the
>> case, explicitly allow non-forward updates.
>>
>> I don't have reason to believe the channel needs to be rolled back, I assume
>> something is wrong with the savannah copy of the repo, but don't know. Can
>> someone confirm?
>
> Can confirm.
[...]
> Given that f13f0769688493271f43f31a016957355dbecb30 has fairly large
> commit message, maybe the known bugs in how we are using guile-git
> finally caught up with us.

I just re-authenticated my existing checkout of Guix from scratch (`rm
-r ~/.cache/guix/authentication/* && guix git authenticate`), and the
authentication was successful. (The checkout is up-to-date, as both
6ca7b07a251739dfaefa639e74c01e3013c9454c and
f13f0769688493271f43f31a016957355dbecb30 can be found in `git log`.)

However, I have not yet pulled 6ca7b07a251739dfaefa639e74c01e3013c9454c.
I'm currently on b9063be5a73114c1bfb23121b7c9b612835d014d [1].

So, I think you're right - it's probably an issue in `guix pull` or the
authentication mechanism, not the Guix repository (assuming that others
can also reproduce this).


[1] ...well, technically, I'm pulling from a personal authenticated fork
    where upstream commits are rebased onto the branch I pull from; so
    the hashes are all different even though the commit contents are all
    the same. So I'm not actually on
    b9063be5a73114c1bfb23121b7c9b612835d014d; rather, that's the last
    commit that I rebased onto my fork branch.




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 02 Mar 2025 18:51:03 GMT) (full text, mbox, link).


Message #14 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>
To: Jack Hill <jackhill@jackhill.us>
Cc: 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sun, 2 Mar 2025 13:50:43 -0500
On Sat, Mar 01, 2025 at 11:37:40AM -0500, Jack Hill wrote:
> guix pull: error: aborting update of channel 'guix' to commit 6ca7b07a251739dfaefa639e74c01e3013c9454c, which is not a descendant of f13f0769688493271f43f31a016957355dbecb30
> hint: This could indicate that the channel has been tampered with and is trying to force a
> roll-back, preventing you from getting the latest updates.  If you think this is not the
> case, explicitly allow non-forward updates.

I successfully pulled from the latest commit on the 'master' branch:

------
$ guix package -p ~/.config/guix/current -l
[...]
Generation 242	Mar 02 2025 13:45:23	(current)
 + nonguix	45bde19	out	/gnu/store/ahqhr9qbhq9w83fl3yif8qy5vfkhay7c-nonguix
 + guix   	56a374a	out	/gnu/store/lfwph6c7099c0f5dzfpffg1qm93va5iv-guix-56a374aa7
 - nonguix	87c5b72	out	/gnu/store/1kbmg93s0sc3ic01pql1jic6nr8mzkhi-nonguix
 - guix   	55a5181	out	/gnu/store/vc2sn17c6g7ww4akd7p9dcfby6zykr81-guix-55a5181e7
------

This commit is a descendant of both of the commits from your error
message.

And `guix git authenticate` succeeds from 56a374a as well.

So what's going on?




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 02 Mar 2025 19:09:03 GMT) (full text, mbox, link).


Message #17 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Tomas Volf <~@wolfsden.cz>
To: Leo Famulari <leo@famulari.name>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sun, 02 Mar 2025 20:08:50 +0100
[Message part 1 (text/plain, inline)]
Leo Famulari <leo@famulari.name> writes:

> On Sat, Mar 01, 2025 at 11:37:40AM -0500, Jack Hill wrote:
>> guix pull: error: aborting update of channel 'guix' to commit 6ca7b07a251739dfaefa639e74c01e3013c9454c, which is not a descendant of f13f0769688493271f43f31a016957355dbecb30
>> hint: This could indicate that the channel has been tampered with and is trying to force a
>> roll-back, preventing you from getting the latest updates.  If you think this is not the
>> case, explicitly allow non-forward updates.
>
> I successfully pulled from the latest commit on the 'master' branch:

Can you pull *any* commit from 6ca7b07a251739dfaefa639e74c01e3013c9454c?
I have just tried:

--8<---------------cut here---------------start------------->8---
$ /tmp/test/profile/bin/guix describe
Generation 1	Mar 01 2025 21:04:08	(current)
  guix f13f076
    repository URL: https://git.savannah.gnu.org/git/guix.git
    commit: f13f0769688493271f43f31a016957355dbecb30
$ /tmp/test/profile/bin/guix pull -q --profile=/tmp/test/profile
Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...
guix pull: error: aborting update of channel 'guix' to commit 56a374aa79fd93a90373417b9a33b27dda633449, which is not a descendant of f13f0769688493271f43f31a016957355dbecb30
hint: This could indicate that the channel has been tampered with and is trying to force a roll-back, preventing you from getting the latest updates.  If you think this is not the case,
explicitly allow non-forward updates.
--8<---------------cut here---------------end--------------->8---

So it does not work for 56a374aa79fd93a90373417b9a33b27dda633449
(current master) on my machine.  Out of curiosity, can you try to pull
current master, but from 6ca7b07a251739dfaefa639e74c01e3013c9454c?

>
> ------
> $ guix package -p ~/.config/guix/current -l
> [...]
> Generation 242	Mar 02 2025 13:45:23	(current)
>  + nonguix	45bde19	out	/gnu/store/ahqhr9qbhq9w83fl3yif8qy5vfkhay7c-nonguix
>  + guix   	56a374a	out	/gnu/store/lfwph6c7099c0f5dzfpffg1qm93va5iv-guix-56a374aa7
>  - nonguix	87c5b72	out	/gnu/store/1kbmg93s0sc3ic01pql1jic6nr8mzkhi-nonguix
>  - guix   	55a5181	out	/gnu/store/vc2sn17c6g7ww4akd7p9dcfby6zykr81-guix-55a5181e7
> ------
>
> This commit is a descendant of both of the commits from your error
> message.
>
> And `guix git authenticate` succeeds from 56a374a as well.
>
> So what's going on?

Possible explanation would be that there is a bug in the descendancy
detection when your current Guix is on specific commits (my guesstimate
would be the trigger is having large commit message, I have reported
this issue before).

Have a nice day,
Tomas

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 02 Mar 2025 22:48:02 GMT) (full text, mbox, link).


Message #20 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>
To: Tomas Volf <~@wolfsden.cz>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sun, 2 Mar 2025 17:47:43 -0500
On Sun, Mar 02, 2025 at 08:08:50PM +0100, Tomas Volf wrote:
> Possible explanation would be that there is a bug in the descendancy
> detection when your current Guix is on specific commits (my guesstimate
> would be the trigger is having large commit message, I have reported
> this issue before).

Can you share these prior reports here?




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 02 Mar 2025 23:41:03 GMT) (full text, mbox, link).


Message #23 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>
To: Tomas Volf <~@wolfsden.cz>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sun, 2 Mar 2025 18:39:55 -0500
On Sun, Mar 02, 2025 at 08:08:50PM +0100, Tomas Volf wrote:
> Can you pull *any* commit from 6ca7b07a251739dfaefa639e74c01e3013c9454c?

Yes:

------
$ guix package -p ~/.config/guix/current -l
[...]
Generation 242	Mar 02 2025 18:24:39
 + guix   	6ca7b07	out	/gnu/store/3bp49nygmmfq340fcgwpslryvqlbmlm9-guix-6ca7b07a2
 - nonguix	87c5b72	out	/gnu/store/1kbmg93s0sc3ic01pql1jic6nr8mzkhi-nonguix
 - guix   	55a5181	out	/gnu/store/vc2sn17c6g7ww4akd7p9dcfby6zykr81-guix-55a5181e7

Generation 243	Mar 02 2025 18:31:47	(current)
 + guix	08bf8d1	out	/gnu/store/0xp5zrr6ii0xwpy0md4bgxqaprijmh47-guix-08bf8d175
 - guix	6ca7b07	out	/gnu/store/3bp49nygmmfq340fcgwpslryvqlbmlm9-guix-6ca7b07a2
------

I did notice that I was unable to pull from 6ca7b07 along with nonguix.
In that case the package-cache failed to build like this:

------
[...]
building package cache...
(repl-version 0 1 1)
Generating package cache for '/gnu/store/b4f6r9wn4wc6mvw2fv6vbm2kz1gpxmgx-profile'...

Backtrace:
In guix/repl.scm:
    141:4 19 (machine-repl _ _)
    126:7 18 (_)
In ice-9/boot-9.scm:
  1747:15 17 (with-exception-handler #<procedure 7fffefeff3f0 at ic…> …)
  1752:10 16 (with-exception-handler _ _ #:unwind? _ # _)
In guix/repl.scm:
    99:21 15 (_)
In unknown file:
          14 (_ #<procedure 7ffff4ab11e0 at guix/repl.scm:100:25 ()> …)
          13 (primitive-load "/gnu/store/3myfgdm742h3r3g3xl4fay58g0a…")
In ice-9/boot-9.scm:
  1752:10 12 (with-exception-handler _ _ #:unwind? _ # _)
In gnu/packages.scm:
   465:11 11 (generate-package-cache _)
In srfi/srfi-1.scm:
   460:18 10 (fold #<procedure expand-cache expr> _ _)
In gnu/packages.scm:
   425:37  9 (expand-cache . _)
In guix/packages.scm:
  1444:17  8 (supported-package? #<package dotnet@3.1.419 nongnu/pa…> …)
In guix/memoization.scm:
    101:0  7 (_ #<hash-table 7fffe09093a0 9870/14051> #<package dot…> …)
In guix/packages.scm:
  1422:39  6 (_)
  1692:16  5 (package->bag _ _ _ #:graft? _)
  1793:48  4 (thunk)
In nongnu/packages/dotnet.scm:
   290:19  3 (inputs #<package dotnet@3.1.419 nongnu/packages/dotnet…>)
In ice-9/boot-9.scm:
  1685:16  2 (raise-exception _ #:continuable? _)
  1780:13  1 (_ #<&compound-exception components: (#<&undefined-vari…>)
In unknown file:
           0 (backtrace #<undefined>)

(exception unbound-variable (value #f) (value "Unbound variable: ~S") (value (icu4c-71)) (value #f))
builder for `/gnu/store/m5jxnijhnkhz2y8210l67g0f9azlqm2n-guix-package-cache.drv' failed to produce output path `/gnu/store/s91dv1ihqdvavmykxialqvgifjfvsl8z-guix-package-cache'
build of /gnu/store/m5jxnijhnkhz2y8210l67g0f9azlqm2n-guix-package-cache.drv failed
hint: This usually indicates a bug in one of the channels you are pulling from, or some incompatibility among them.  You can check the build log and report the issue to the channel developers.

The channels you are pulling from are: nonguix guix.
------




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 02 Mar 2025 23:45:02 GMT) (full text, mbox, link).


Message #26 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Tomas Volf <~@wolfsden.cz>
To: Leo Famulari <leo@famulari.name>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Mon, 03 Mar 2025 00:44:19 +0100
[Message part 1 (text/plain, inline)]
Leo Famulari <leo@famulari.name> writes:

> On Sun, Mar 02, 2025 at 08:08:50PM +0100, Tomas Volf wrote:
>> Possible explanation would be that there is a bug in the descendancy
>> detection when your current Guix is on specific commits (my guesstimate
>> would be the trigger is having large commit message, I have reported
>> this issue before).
>
> Can you share these prior reports here?

I expect the root cause to be the same as in 66268.  (Man, is it over an
year already?  The time sure does fly.)

I assume this[0] commit from my fork should fix the issue, does not
apply cleanly (should be trivial to adjust).  The current way to compare
commits from guile-git (eq?) is simply wrong.

Tomas

0: https://git.wolfsden.cz/guix/commit/?id=2e52fbc6fed667f938db1d743e279e3f4a1a1658

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sat, 08 Mar 2025 03:17:02 GMT) (full text, mbox, link).


Message #29 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Jack Hill <jackhill@jackhill.us>
To: Tomas Volf <~@wolfsden.cz>
Cc: 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Fri, 7 Mar 2025 22:16:07 -0500 (EST)
Assuming I understand correctly that there's no way to get this commit to 
verify: what are the next steps?

Future looking, we should apply the patch so that we don't get 
non-verifiable commits in the future, but that won't help me, since I'll 
have to verify it with my current guix.

How can I reset my state and move forward in a safe way? I assume it 
involves some manually verifying of commits?

I'm afraid I don't understand why only some people run into this problem.

Thanks!
Jack





Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 09 Mar 2025 09:34:02 GMT) (full text, mbox, link).


Message #32 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Tomas Volf <~@wolfsden.cz>
To: Jack Hill <jackhill@jackhill.us>
Cc: 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sun, 09 Mar 2025 10:33:45 +0100
Jack Hill <jackhill@jackhill.us> writes:

> Assuming I understand correctly that there's no way to get this commit to
> verify: what are the next steps?
>
> Future looking, we should apply the patch so that we don't get non-verifiable
> commits in the future, but that won't help me, since I'll have to verify it with
> my current guix.
>
> How can I reset my state and move forward in a safe way? I assume it involves
> some manually verifying of commits?

I see few options:

1. Revert to previous good state using `guix pull --roll-back', and try
   pulling again.  Maybe it will help.

2. Checkout the Guix repository, switch to the last commit known to you
   to be safe, patch the guix/git.scm file ([0] should now apply
   clearly), build the modified Guix locally and pull using it.

3. Take someones word that some specific new commit is safe, and just
   pull while disabling protections.  Statistically, if few people
   independently confirm the commit on IRC, if should be pretty safe.

Number 1 is probably quickest to just try. :)

>
> I'm afraid I don't understand why only some people run into this
> problem.

I think it could be influenced by the commit you are currently on, and
the commit you are pulling as latest.  So depending on time of previous
and current pull, it might work or it might not work.  I assume that
limits the amount of affected people.

>
> Thanks!
> Jack
>

0: https://git.wolfsden.cz/guix/tree/etc/0001-git-Fix-usage-of-guile-git.patch

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 09 Mar 2025 21:32:01 GMT) (full text, mbox, link).


Message #35 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>
To: Tomas Volf <~@wolfsden.cz>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sun, 9 Mar 2025 17:31:15 -0400
On Sun, Mar 09, 2025 at 10:33:45AM +0100, Tomas Volf wrote:
> I think it could be influenced by the commit you are currently on, and
> the commit you are pulling as latest.  So depending on time of previous
> and current pull, it might work or it might not work.  I assume that
> limits the amount of affected people.

Yes, it might or might not work. Some of us can pull from the "bad
commit", and some of us can't:

https://issues.guix.gnu.org/76660#6

So, either we don't understand all the conditions that trigger this bug,
or it's not deterministic. But we should work to get the fix into
guile-git.




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Sun, 09 Mar 2025 23:39:01 GMT) (full text, mbox, link).


Message #38 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Tomas Volf <~@wolfsden.cz>
To: Leo Famulari <leo@famulari.name>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Mon, 10 Mar 2025 00:38:20 +0100
[Message part 1 (text/plain, inline)]
Leo Famulari <leo@famulari.name> writes:

> On Sun, Mar 09, 2025 at 10:33:45AM +0100, Tomas Volf wrote:
>> I think it could be influenced by the commit you are currently on, and
>> the commit you are pulling as latest.  So depending on time of previous
>> and current pull, it might work or it might not work.  I assume that
>> limits the amount of affected people.
>
> Yes, it might or might not work. Some of us can pull from the "bad
> commit", and some of us can't:
>
> https://issues.guix.gnu.org/76660#6
>
> So, either we don't understand all the conditions that trigger this bug,
> or it's not deterministic. But we should work to get the fix into
> guile-git.

There is nothing to fix in guile-git, the fix needs to go into (guix
git).  The libgit2 (which guile-git is wrapping) simply does not
guarantee that two gets of the same commit hash will return identical
pointer.  So I believe (guix git) is in the wrong here for using eq?.

Well, I guess guile-git could go beyond what libgit2 promises, and
introduce its own caching layer, but I am not sure that is the correct
course of action.  But its up to Ludo' of course.

Tomas

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Mon, 10 Mar 2025 03:28:02 GMT) (full text, mbox, link).


Message #41 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>
To: Tomas Volf <~@wolfsden.cz>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Sun, 9 Mar 2025 23:27:12 -0400
On Mon, Mar 10, 2025 at 12:38:20AM +0100, Tomas Volf wrote:
> There is nothing to fix in guile-git, the fix needs to go into (guix
> git). 

Sorry, my mistake.




Changed bug title to 'Downgrade prevention triggers erroneously with 'guix pull'' from 'current guix pull doesn't authenticate' Request was from Ludovic Courtès <ludo@gnu.org> to control@debbugs.gnu.org. (Mon, 10 Mar 2025 14:25:02 GMT) (full text, mbox, link).


Severity set to 'important' from 'normal' Request was from Ludovic Courtès <ludo@gnu.org> to control@debbugs.gnu.org. (Mon, 10 Mar 2025 14:25:03 GMT) (full text, mbox, link).


Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Mon, 10 Mar 2025 14:29:02 GMT) (full text, mbox, link).


Message #48 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Ludovic Courtès <ludo@gnu.org>
To: Tomas Volf <~@wolfsden.cz>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Mon, 10 Mar 2025 15:27:56 +0100
Tomas Volf <~@wolfsden.cz> skribis:

> Leo Famulari <leo@famulari.name> writes:
>
>> On Sun, Mar 02, 2025 at 08:08:50PM +0100, Tomas Volf wrote:
>>> Possible explanation would be that there is a bug in the descendancy
>>> detection when your current Guix is on specific commits (my guesstimate
>>> would be the trigger is having large commit message, I have reported
>>> this issue before).
>>
>> Can you share these prior reports here?
>
> I expect the root cause to be the same as in 66268.  (Man, is it over an
> year already?  The time sure does fly.)

It looks like it!  Terrible that such a serious bug didn’t triaged
appropriately.

I relied there, let’s see how we can fix it.

Thanks,
Ludo’.




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Mon, 10 Mar 2025 19:48:06 GMT) (full text, mbox, link).


Message #51 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Simon Tournier <zimon.toutoune@gmail.com>
To: Ludovic Courtès <ludo@gnu.org>, Tomas Volf <~@wolfsden.cz>
Cc: Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Mon, 10 Mar 2025 20:46:32 +0100
Hi,

On Mon, 10 Mar 2025 at 15:27, Ludovic Courtès <ludo@gnu.org> wrote:

>> I expect the root cause to be the same as in 66268.  (Man, is it over an
>> year already?  The time sure does fly.)
>
> It looks like it!  Terrible that such a serious bug didn’t triaged
> appropriately.

Somehow, the fix seems to rely on “git merge-base --is-ancestor” for
implementing “commit-relation”?

Since “build: Add dependency on Git” commit
f651a359691cbe4750f1fe8d14dd964f7971f91 from Sep 26 2023 we can assume
Git is available by the code that run “commit-relation”, no?

And, to my knowledge, the implementation relying on “git merge-base
--is-ancestor” does not have the problem, right?

Last cherry on the top, from [1], the implementation relying on “git
merge-base --is-ancestor” is 35x faster.

Win-win, no?  Because the fix for ’eq?’  will introduce performance cost
and ’commit-relation’ will be even slower, no?

Cheers,
simon

1: comparing commit-relation using Scheme+libgit2 vs shellout plumbing Git
Simon Tournier <zimon.toutoune@gmail.com>
Tue, 12 Sep 2023 00:48:30 +0200
id:865y4gz5q9.fsf@gmail.com
https://lists.gnu.org/archive/html/guix-devel/2023-09
https://yhetil.org/guix/865y4gz5q9.fsf@gmail.com




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Mon, 10 Mar 2025 21:58:01 GMT) (full text, mbox, link).


Message #54 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Ludovic Courtès <ludo@gnu.org>
To: Simon Tournier <zimon.toutoune@gmail.com>
Cc: Tomas Volf <~@wolfsden.cz>, Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Mon, 10 Mar 2025 22:57:23 +0100
Simon Tournier <zimon.toutoune@gmail.com> skribis:

> Last cherry on the top, from [1], the implementation relying on “git
> merge-base --is-ancestor” is 35x faster.

Uh, interesting!  I would still like to avoid shelling out to Git for
common operations, but this comparison shows there’s a lot of room to
improve the performance of the current implementation.

Ludo’.




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Tue, 11 Mar 2025 03:20:02 GMT) (full text, mbox, link).


Message #57 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Jack Hill <jackhill@jackhill.us>
To: Tomas Volf <~@wolfsden.cz>
Cc: 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Mon, 10 Mar 2025 23:19:35 -0400 (EDT)
On Sun, 9 Mar 2025, Tomas Volf wrote:

> I see few options:
>
> 1. Revert to previous good state using `guix pull --roll-back', and try
>   pulling again.  Maybe it will help.

I reverted back to the oldest guix I had, 
4eaeff997907bc1b67884a6dc087756a50f175e2, and was able to pull with 
authentication up to the newest, 42773718d5d5d42137ac84826850256fd6bed606.

Many thanks!
Jack




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Tue, 25 Mar 2025 13:02:02 GMT) (full text, mbox, link).


Message #60 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Simon Tournier <zimon.toutoune@gmail.com>
To: Ludovic Courtès <ludo@gnu.org>
Cc: Tomas Volf <~@wolfsden.cz>, Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Mon, 24 Mar 2025 13:48:56 +0100
Hi Ludo,

On Mon, 10 Mar 2025 at 22:57, Ludovic Courtès <ludo@gnu.org> wrote:
> Simon Tournier <zimon.toutoune@gmail.com> skribis:
>
>> Last cherry on the top, from [1], the implementation relying on “git
>> merge-base --is-ancestor” is 35x faster.
>
> Uh, interesting!  I would still like to avoid shelling out to Git for
> common operations, but this comparison shows there’s a lot of room to
> improve the performance of the current implementation.

You mean the current implementation of ligbit2, right?  Because, from my
poor understanding, it’s part of the performance barrier.

Cheers,
simon




Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Tue, 25 Mar 2025 21:02:01 GMT) (full text, mbox, link).


Message #63 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: Tomas Volf <~@wolfsden.cz>
To: Simon Tournier <zimon.toutoune@gmail.com>
Cc: Ludovic Courtès <ludo@gnu.org>, Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Tue, 25 Mar 2025 22:01:02 +0100
[Message part 1 (text/plain, inline)]
Simon Tournier <zimon.toutoune@gmail.com> writes:

> Hi Ludo,
>
> On Mon, 10 Mar 2025 at 22:57, Ludovic Courtès <ludo@gnu.org> wrote:
>> Simon Tournier <zimon.toutoune@gmail.com> skribis:
>>
>>> Last cherry on the top, from [1], the implementation relying on “git
>>> merge-base --is-ancestor” is 35x faster.
>>
>> Uh, interesting!  I would still like to avoid shelling out to Git for
>> common operations, but this comparison shows there’s a lot of room to
>> improve the performance of the current implementation.
>
> You mean the current implementation of ligbit2, right?  Because, from my
> poor understanding, it’s part of the performance barrier.

There is git_graph_descendant_of function in libgit2, but it is not
exposed by the guile-git binding.  Maybe we could try to use it to
implement the check instead the current approach (which does it in
Guile).  I wonder how well that would perform compared to --is-ancestor.

Tomas

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix@gnu.org:
bug#76660; Package guix. (Wed, 26 Mar 2025 11:35:01 GMT) (full text, mbox, link).


Message #66 received at 76660@debbugs.gnu.org (full text, mbox, reply):

From: 45mg <45mg.writes@gmail.com>
To: Tomas Volf <~@wolfsden.cz>, Simon Tournier <zimon.toutoune@gmail.com>
Cc: Ludovic Courtès <ludo@gnu.org>, Jack Hill <jackhill@jackhill.us>, 76660@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: Re: bug#76660: current guix pull doesn't authenticate
Date: Wed, 26 Mar 2025 11:34:29 +0000
Tomas Volf <~@wolfsden.cz> writes:

> There is git_graph_descendant_of function in libgit2, but it is not
> exposed by the guile-git binding.  Maybe we could try to use it to
> implement the check instead the current approach (which does it in
> Guile).  I wonder how well that would perform compared to --is-ancestor.

I actually opened a MR to add that binding upstream. Maybe copying the
code from there might save you a little bit of work:

https://gitlab.com/guile-git/guile-git/-/merge_requests/38




Send a report that this bug log contains spam.


debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Wed Apr 9 19:06:24 2025; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.