Fixes <https://bugs.gnu.org/37744>.
Reported at <https://www.openwall.com/lists/oss-security/2019/10/09/4>.
Based on Nix commit 5a303093dcae1e5ce9212616ef18f2ca51020b0d
by Eelco Dolstra <edolstra@gmail.com>.
* nix/libstore/local-store.cc (LocalStore::LocalStore): Set 'perUserDir'
to #o755 instead of #o1777.
(LocalStore::createUser): New function.
* nix/libstore/local-store.hh (LocalStore): Add it.
* nix/libstore/store-api.hh (StoreAPI): Add it.
* nix/nix-daemon/nix-daemon.cc (performOp): In 'wopSetOptions', add
condition to handle "user-name" property and honor it.
(processConnection): Add 'userId' parameter. Call 'store->createUser'
when userId is not -1.
* guix/profiles.scm (ensure-profile-directory): Note that this is now
handled by the daemon.
* guix/store.scm (current-user-name): New procedure.
(set-build-options): Add #:user-name parameter and pass it to the daemon.
* tests/guix-daemon.sh: Test the creation of 'profiles/per-user' when
listening on a TCP socket.
* tests/store.scm ("profiles/per-user exists and is not writable")
("profiles/per-user/$USER exists"): New tests.
* guix/build/syscalls.scm (RNDADDTOENTCNT): New variable.
(add-to-entropy-count): New procedure.
* tests/syscalls.scm ("add-to-entropy-count"): New test.
Previously we would, for example, generate build scripts in the store;
when trying to run them, we'd get a 'read' error due to the presence
of #<foo> syntax in there.
* guix/gexp.scm (gexp->sexp)[self-quoting?]: New procedure.
[reference->sexp]: Check whether the argument in a <gexp-input> box is
self-quoting. Raise a '&gexp-input-error' condition if it's not.
* tests/gexp.scm ("lower-gexp, non-self-quoting input"): New test.
Suggested by Ricardo Wurmus <rekado@elephly.net>.
* guix/channels.scm (<channel-news-entry>)[tag]: New field.
(sexp->channel-news-entry): Accept either 'commit' or 'tag' in 'entry'
forms.
(resolve-channel-news-entry-tag): New procedure.
(channel-news-for-commit): Move 'with-repository' form one level
higher. Call 'resolve-channel-news-entry-tag' on all the news entries.
* guix/tests/git.scm (populate-git-repository): Add clause for 'tag'.
* tests/channels.scm ("channel-news, one entry"): Create a tag and add
an entry with a tag. Check that the tag is resolved and also visible in
the <channel-news-entry> record.
* doc/guix.texi (Channels): Mention tags in news entries.
* guix/channels.scm (<channel-metadata>)[news-file]: New field.
(read-channel-metadata): Set the 'news-file' field.
(read-channel-metadata-from-source): Likewise.
(<channel-news>, <channel-news-entry>): New record types.
(sexp->channel-news-entry, read-channel-news)
(channel-news-for-commit): New procedures.
* guix/tests/git.scm (populate-git-repository): For 'add', allow
CONTENTS to be a procedure.
* tests/channels.scm ("channel-news, no news")
("channel-news, one entry"): New tests.
* doc/guix.texi (Channels): Document it.
* guix/scripts/show.scm: New file.
* Makefile.am (MODULES): Add it.
* po/guix/POTFILES.in: Add it.
* tests/guix-package-aliases.sh: Add test.
* doc/guix.texi (Invoking guix package): Document it and use it in a example.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Until now '&store-protocol-error' conditions raised in the inferior
would not be correctly propagated because SRFI-35 records lack a read
syntax.
Reported at <https://bugs.gnu.org/37449>
by Carl Dong <contact@carldong.me>.
* guix/inferior.scm (port->inferior): Import (srfi srfi-34) in the inferior.
(inferior-eval-with-store): Define 'error?' and 'error-message'. Wrap
call to PROC in 'guard'. Check the response of INFERIOR for a
'store-protocol-error' or a 'result' tag.
* tests/inferior.scm ("inferior-eval-with-store, &store-protocol-error"):
New test.
Fixes <https://bugs.gnu.org/36763>.
Previously, the logical and connecting the regexps did not output the expected
results (introduced in 8874faaaac).
* guix/ui.scm (relevance)
[score]: Change its arguments.
[regexp->score]: New procedure.
* tests/ui.scm ("package-relevance"): Add test.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This fixes a type error.
* gnu/system/linux-container.scm (eval/container): Use 'append-map', not
'map'.
* tests/containers.scm ("eval/container, non-empty load path"): New test.
See http://debbugs.gnu.org/cgi/bugreport.cgi?bug=37318.
* gnu/services/networking.scm (openntpd-configuration->string): New procedure,
extracted from top of the `openntpd-shepherd-service' to make it testable.
(openntpd-shepherd-service): Adapt following the move of the code to the above
procedure.
* tests/networking.scm: Add a test for the `openntpd-configuration->string'
procedure.
* gnu/services/networking.scm (ntp-server-types): New enum.
(<ntp-server>): New record type.
(ntp-server->string): New procedure.
(%ntp-servers): Define in terms of <htp-server> records. Use the first
entrypoint server as a pool instead of a list of static servers. This is more
resilient since a new server of the pool can be interrogated on every
request. Add the 'iburst' options.
(ntp-configuration-servers): Define a custom accessor that warns but honors
the now deprecated server format.
(<ntp-configuration>): Use it.
(%openntpd-servers): New variable,
(<openntpd-configuration>): Use it, as a pool ('servers' field) instead of a
regular server.
* tests/networking.scm: New file.
* Makefile.am (SCM_TESTS): Register it.
* doc/guix.texi: Update documentation.
Previously, (supported-package? coreutils "armhf-linux")
with (%current-system) = "x86_64-linux" would return false. That's
because 'supported-package?' would traverse the x86_64 dependency graph,
which contains 'tcc-boot0', which supports x86 only.
Consequently, 'supported-package?' would match only 53 packages for
"armhf-linux" when running on x86, as is the case during continuous
integration.
* guix/packages.scm (package-transitive-supported-systems): Add an
optional 'system' parameter. Use 'mlambda' instead of 'mlambdaq' for
memoization.
(supported-package?): Pass 'system' to 'package-transitive-supported-systems'.
* tests/packages.scm ("package-transitive-supported-systems, implicit inputs")
("package-transitive-supported-systems: reduced binary seed, implicit inputs"):
Remove calls to 'invalidate-memoization!', which no longer work and were
presumably introduced to work around the bug we're fixing (see commit
0db65c168f).
* tests/packages.scm ("supported-package?"): Rewrite test to use only
existing system name since otherwise 'bootstrap-executable' raises an
exception.
("supported-package? vs. system-dependent graph"): New test.
* guix/import/crate.scm (%dual-license-rx): New variable.
(crate->guix-package)[string->license]: Rewrite to match it.
* tests/crate.scm (test-crate): Adjust "license" field to current
practice.
This provides a clean separation between bindings to the
https://crates.io/api/v1 API and actual conversion to Guix package
sexps.
As a side-effect, it fixes things like "guix import blake2-rfc", "guix
refresh -t crates", etc.
* guix/import/crate.scm (<crate>, <crate-version>, <crate-dependency>):
New record types.
(lookup-crate, crate-version-dependencies): New procedures.
(crate-fetch): Remove.
(crate->guix-package): Rewrite to use the new API.
(latest-release): Likewise.
* guix/build-system/cargo.scm (%crate-base-url): New variable.
* tests/crate.scm (test-crate): Update accordingly.
fixlet
* guix/swh.scm (%allow-request?, %save-rate-limit-reset-time)
(%general-rate-limit-reset-time): New variables.
(request-rate-limit-reached?, update-rate-limit-reset-time!): New
procedures.
(call): Call '%allow-request?'. Change 'swh-error' protocol to pass
METHOD in addition to URL.
* tests/swh.scm ("rate limit reached")
("%allow-request? and request-rate-limit-reached?"): New tests.
* guix/tests/http.scm (call-with-http-server): Replace 'code' and 'data'
parameters with 'responses+data'. Compute RESPONSES as a function of
that. Remove #:headers parameter.
[http-write]: Quit only when RESPONSES is empty.
[server-body]: Get the response and data from RESPONSES, and set it to
point to the rest.
(with-http-server): Adjust accordingly.
* tests/derivations.scm ("'download' built-in builder")
("'download' built-in builder, invalid hash")
("'download' built-in builder, not found")
("'download' built-in builder, check mode"): Adjust to new
'with-http-server' interface.
* tests/lint.scm ("home-page: 200")
("home-page: 200 but short length")
("home-page: 404", "home-page: 301, invalid"):
("home-page: 301 -> 200", "home-page: 301 -> 404")
("source: 200", "source: 200 but short length")
("source: 404", "source: 404 and 200")
("source: 301 -> 200", "source: 301 -> 404"):
("github-url", github-url): Likewise.
* tests/swh.scm (with-json-result)
("lookup-origin, not found"): Likewise.
When adding multiple instances of a service requiring some user
account/group, we could end up with multiple entries for that account or
group in /etc/passwd or /etc/group.
* gnu/build/accounts.scm (database-writer)[write-entries]: Add call to
'delete-duplicates'.
* tests/accounts.scm ("write-passwd with duplicate entry"): New test.
Fixes <https://bugs.gnu.org/37161>.
* guix/scripts/pack.scm (docker-image)[build]: Add a 'directory' entry
for "/tmp" to DIRECTIVES.
* tests/pack.scm ("docker-image + localstatedir"): Test the presence of /tmp.
* gnu/tests/docker.scm (run-docker-test)["Load docker image and run
it"]: Test the presence and permission bits of "/tmp".
Fixes <https://bugs.gnu.org/36925>.
Reported by Jesse Gibbons <jgibbons2357@gmail.com>.
* guix/scripts/pack.scm (wrapped-package): Add 'output*' parameter.
[build]: Define 'input' and 'target'; use them instead of #$package and
#$output, respectively.
(wrapped-manifest-entry): New procedure.
(map-manifest-entries): Call PROC directly.
(guix-pack): Pass WRAPPED-MANIFEST-ENTRY to 'map-manifest-entries'.
In guile-json version 3, JSON objects are represented as hash tables, rather
than alists.
* guix/import/cpan.scm (string->license): Change the match expression to match
on lists, rather than vectors.
(module->dist-name, cpan-source-url, cpan-version): Change assoc-ref to
hash-ref.
(cpan-module->sexp): Change assoc-ref to hash-ref, and assoc-ref* to
hash-ref*.
* tests/cpan.scm ("source-url-http", "source-url-https"): Convert the alist to
a hash table.
This ensures that this test is skipped in contexts where user namespaces
are not supported, instead of failing.
This is a followup to commit b6dc08393e.
* tests/guix-environment.sh: Move '--container --no-cwd' test to...
* tests/guix-environment-container.sh: ... here.
Fixes a regression introduced in
50fc2384fe.
* tests/lint.scm (warning-contains?): New procedure.
("home-page: host not found"): Use 'warning-contains?' instead of
testing for equality, as was the case before commit 50fc2384fe.
This handles the case where the 'getaddrinfo' error is not "Name or
service not known" but instead something like "System error" or
"Servname not supported for ai_socktype", as is the case in the build
environment.
Fixes <https://bugs.gnu.org/36777>.
Reported by Carl Dong <contact@carldong.me>.
* guix/derivations.scm (derivation/masked-inputs): Call
'delete-duplicates' on INPUTS.
* tests/derivations.scm ("derivation with duplicate fixed-output inputs"):
New test.
Fixes <https://bugs.gnu.org/36813>.
Reported by Jakob L. Kreuze <zerodaysfordays.sdf.org@sdf.org>.
* guix/gexp.scm (program-file-compiler): Pass #:system and #:target to
'gexp->script'.
(load-path-expression): Add #:system and #:target and honor them.
(gexp->script): Likewise.
* tests/gexp.scm ("program-file #:system"): New test.
* doc/guix.texi (G-Expressions): Adjust accordingly.
Guile-JSON 3.x is incompatible with Guile-JSON 1.x, which we relied on
until now: it maps JSON dictionaries to alists (instead of hash tables),
and JSON arrays to vectors (instead of lists). This commit is about
adjusting all the existing code to this new mapping.
* m4/guix.m4 (GUIX_CHECK_GUILE_JSON): New macro.
* configure.ac: Use it.
* doc/guix.texi (Requirements): Mention the Guile-JSON version.
* guix/git-download.scm (git-fetch)[guile-json]: Use GUILE-JSON-3.
* guix/import/cpan.scm (string->license): Expect vectors instead of
lists.
(module->dist-name): Use 'json-fetch' instead of 'json-fetch-alist'.
(cpan-fetch): Likewise.
* guix/import/crate.scm (crate-fetch): Likewise, and call 'vector->list'
for DEPS.
* guix/import/gem.scm (rubygems-fetch): Likewise.
* guix/import/json.scm (json-fetch-alist): Remove.
* guix/import/pypi.scm (pypi-fetch): Use 'json-fetch' instead of
'json-fetch-alist'.
(latest-source-release, latest-wheel-release): Call 'vector->list' on
RELEASES.
* guix/import/stackage.scm (stackage-lts-info-fetch): Use 'json-fetch'
instead of 'json-fetch-alist'.
(lts-package-version): Use 'vector->list'.
* guix/import/utils.scm (hash-table->alist): Remove.
(alist->package): Pass 'vector->list' on the inputs fields, and default
to the empty vector.
* guix/scripts/import/json.scm (guix-import-json): Remove call to
'hash-table->alist'.
* guix/swh.scm (define-json-reader): Expect pair? or null? instead of
hash-table?.
[extract-field]: Use 'assoc-ref' instead of 'hash-ref'.
(json->branches): Use 'map' instead of 'hash-map->list'.
(json->checksums): Likewise.
(json->directory-entries, origin-visits): Call 'vector->list' on the
result of 'json->scm'.
* tests/import-utils.scm ("alist->package with dependencies"): New test.
* gnu/installer.scm (build-compiled-file)[builder]: Use GUILE-JSON-3.
* gnu/installer.scm (installer-program)[installer-builder]: Likewise.
* gnu/installer/locale.scm (iso639->iso639-languages): Use 'assoc-ref'
instead of 'hash-ref', and pass vectors through 'vector->list'.
(iso3166->iso3166-territories): Likewise.
* gnu/system/vm.scm (system-docker-image)[build]: Use GUILE-JSON-3.
* guix/docker.scm (manifest, config): Adjust for Guile-JSON 3.
* guix/scripts/pack.scm (docker-image)[build]: Use GUILE-JSON-3.
* guix/import/github.scm (fetch-releases-or-tags): Update docstring.
(latest-released-version): Use 'assoc-ref' instead of 'hash-ref'. Pass
the result of 'fetch-releases-or-tags' to 'vector->list'.
* guix/import/launchpad.scm (latest-released-version): Likewise.
This is a followup to f363c836e0.
* tests/lint.scm ("cve")
("cve: one vulnerability")
("cve: one patched vulnerability")
("cve: known safe from vulnerability")
("cve: vulnerability fixed in replacement version")
("cve: patched vulnerability in replacement"): Refer to
'package-vulnerabilities' from (guix lint), not (guix scripts lint).
Ludovic Courtès
Ricardo Wurmus
Marius Bakke
zimoun
Maxim Cournoyer
Julien Lepiller
Mark H Weaver
Ludovic Courtès
Christopher Baines
Jakob L. Kreuze