From debbugs-submit-bounces@debbugs.gnu.org Fri Oct 20 17:17:08 2017 Received: (at 28659) by debbugs.gnu.org; 20 Oct 2017 21:17:08 +0000 Received: from localhost ([127.0.0.1]:52855 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e5efE-0000Fk-7I for submit@debbugs.gnu.org; Fri, 20 Oct 2017 17:17:08 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:34679) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e5efC-0000Fd-I4 for 28659@debbugs.gnu.org; Fri, 20 Oct 2017 17:17:07 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 0912420C4F; Fri, 20 Oct 2017 17:17:06 -0400 (EDT) Received: from frontend1 ([10.202.2.160]) by compute4.internal (MEProxy); Fri, 20 Oct 2017 17:17:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=cc:content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=H+edYyOKPo0WMKxnBoSbe1dwsaN7Y/26R63RFQWbKXY=; b=HPxIZ FgP1NENGv8itWV0wnPuXYisy5aVhmMmxuM/cG8dhLXhoNS72izq84eKx+cek467F 63H6FuxDH9cUMMFZcUe9eKsSGBgHw8ShVUco2WjC+lczDCJwzcHSRGuDGTz4vnQB n72vs4FZdQAlHeBBNF1OPx+qtBYiqrLFdHN4Sg= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm1; bh=H+edYyOKPo0WMKxnBoSbe1dwsaN7Y /26R63RFQWbKXY=; b=GDqzyUioFAr8qIMXvXXhOlEXU+JqQnZExZtlpV4LY4wyO QE9Hz/pR6BPBeMnd1PM8CRtlAHnlB+832oDCSC+yrcvC6p78nfA+l4YW7ibkAeZg ZDwdggrSc9N/pxajdJ+i4HPXacE0rSmWMDvERh15blS/rBQTtgEndlqvcCAH3RPh YfpufbR7arOSaKUQRSpr4t1TOV7KpRlnA9Po48bU//ItLmc4M3YLz7kLuOf44vXy UK/I9VJpQDySY0Zj72G8cU7Gwp3gaQgNvKXrHYp/LEuNSD4Hcfj5XwwQ/xKS9ONV PZlv7IHk0CyKgniOhhFgglcMSt6viSe6bwoxgakjQ== X-ME-Sender: Received: from localhost (c-73-165-108-70.hsd1.pa.comcast.net [73.165.108.70]) by mail.messagingengine.com (Postfix) with ESMTPA id BDB507FA7E; Fri, 20 Oct 2017 17:17:05 -0400 (EDT) Date: Fri, 20 Oct 2017 17:17:00 -0400 From: Leo Famulari To: Ludovic =?iso-8859-1?Q?Court=E8s?= Subject: Re: bug#28659: v0.13: guix pull fails; libgit2-0.26.0 and 0.25.1 content hashes fail Message-ID: <20171020211700.GA32355@jasmine.lan> References: <877ewf18d4.fsf@gnu.org> <87o9ppoabw.fsf@gnu.org> <20171002182208.GB10773@jasmine.lan> <878tgt721q.fsf@gnu.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="AqsLC8rIMeq19msA" Content-Disposition: inline In-Reply-To: <878tgt721q.fsf@gnu.org> User-Agent: Mutt/1.9.1 (2017-09-22) X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 28659 Cc: 28659@debbugs.gnu.org, Jan Nieuwenhuizen X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) --AqsLC8rIMeq19msA Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Oct 02, 2017 at 10:00:33PM +0200, Ludovic Court=C3=A8s wrote: > Right. Jan suggested checking the content-addressed mirrors *before* > the real upstream address. That would address the problem of upstream > sources modified in-place, but at the cost of privacy/self-sufficiency > as you note. (Though it=E2=80=99s not really making =E2=80=9Cprivacy=E2= =80=9D any worse in this > case: it=E2=80=99s gnu.org vs. github.com.) Yeah, I don't personally think there is a privacy issue with fetching sources from our mirrors at gnu.org, or other domains we control. > Perhaps we should make content-addressed mirrors configurable in a way > that=E2=80=99s orthogonal to derivations, something similar in spirit to > --substitute-urls? The difficulty is that content-addressed mirrors are > not just URLs; see (guix download). > > Thoughts? I do think we should make it so that users don't suffer from unreliable upstream sources when we know the sources are available on our servers (or the Nix mirror), even with --no-substitutes. --AqsLC8rIMeq19msA Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlnqZ8kACgkQJkb6MLrK fwg5TQ/8CX5M/DfOOi27pQHOXUE91v7o87jnOSazE2Xqzq+q8N7iBZsY+DxQR676 5KmOw/MREsqP1rWBy4eR5nDRuhQv/hgOSpxh1Kyluk5KkqGezhyCmgmRBqVJnoF6 uZw9VD0UBxcYoZScvemtJjBRFCwjFjpUINW1XE5sUXV7CCqI007kvKB+2Q6iyxBz R1pK5cMhWFj7GsOoXtYCUIlxER8tK/lE6Tx0OP264TidenTDfH7dy7udmFbNTRYz 72LKl1xno7rIvgRSHA8mxRlAcLXFCXqlbad7QFHEnEQdLmeoLyF565bE/VsH1CdQ jHW7BJM9svBLmXwfxMOT3YLXGGPgGFI5Kou/uatWmh3PFRvRffe/m97SsA2BYDyh C08pY8DC+HSoTeF/GZO08Jfg3gT3o9pp+IJRt/AE7qhYqLOkX/zQ6guLm6H1jJIJ y4dgoy+Mlu8mwVOhsEvnjVLfk7Ho3QvHLcwzKzDrW001Od6bve7CuLW9pHkbOwqm m7QopDt0XLnL+MTG3o2Lvxbhb5u4rCKfu7Bjb1U01hXlgJWVlULzv4/7voRe1Y1Y cEax9IBjCnRa2ANa+IX6z/trQr9J/gSMjjtS/Uim15728PY19Mm27ZyleJX8lzbG SIf+0jpzWLMFSKZ8hr04XNYrdZjANRruWQa9Pt7p6QdlIiX4lqc= =jxqv -----END PGP SIGNATURE----- --AqsLC8rIMeq19msA--