guix: fix suggested fake date for openssl-1.1.1l #29999

Sjors · 2024-04-29T18:48:05Z

Using 2020-10-01 as the fake timestamp will cause many test failures with /gnu/store/bfirgq65ndhf63nn4q6vlkbha9zd931q-openssl-1.1.1l.drv. I didn't investigate why, but I guess because it's before the test certificates were created. They expired in June 2022. I tried a month before that, which worked.

Also fixes layout of instructions.

Also fix layout of instructions.

DrahtBot · 2024-04-29T18:48:08Z

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage

For detailed information about the code coverage, see the test coverage report.

Reviews

See the guideline for information on the review process.

Type	Reviewers
ACK	maflcko, achow101

If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

Sjors · 2024-04-29T18:55:41Z

cc @dongcarl

laanwj · 2024-04-29T19:08:02Z

Changing the system date is a terrible workaround in any case imo. Is there really no other way?

Sjors · 2024-04-29T19:50:10Z

@laanwj I believe newer versions of OpenSSL have more robust tests, but we don't want to bump our Guix Time Machine commit just for that.

dongcarl · 2024-04-30T17:08:45Z

If I remember correctly, I think that you can likely just patch OpenSSL here since it's not a package that is "core" to Guix like GnuTLS was?

Sjors · 2024-04-30T17:50:45Z

I wrote:

we don't want to bump our Guix Time Machine commit just for that.

Actually our Time Machine commit is much more recent than I thought. Will defer to @dongcarl.

maflcko · 2024-04-30T18:03:41Z

we don't want to bump our Guix Time Machine commit just for that.

Actually our Time Machine commit is much more recent than I thought.

I presume openssl is used in the bootstrap chain, to bootstrap older software, so it probably can never be removed in a time machine bump?

maflcko · 2024-04-30T18:04:52Z

If I remember correctly, I think that you can likely just patch OpenSSL here since it's not a package that is "core" to Guix like GnuTLS was?

Yes, this is workaround 3, added in fad444f.

"Workaround 3: Disable the tests in the Guix source code for this single derivation"

Sjors · 2024-04-30T18:09:54Z

Disable the tests in the Guix source code for this single derivation

We already have that recommendation, but I think it's better to offer an alternative. "Don't worry about tests not passing" is something I prefer to only do when I really understand how everything works, which I don't.

luke-jr · 2024-05-07T17:27:07Z

Is it possible to use a UTS namespace to spoof the clock just for the build?

maflcko

review ACK 8fee535

I didn't test, but suggesting a data should be harmless, even if it is wrong.

maflcko · 2024-07-26T11:07:02Z

contrib/guix/INSTALL.md

-5. Set system time back to accurate current time
-6. Turn NTP back on
+
+1. Turn off NTP


While touching, it may be better to not use numbers. If someone can't figure out the order, they likely have other problems.

maflcko · 2024-07-26T11:08:24Z

Longer term it would be nicer (or at least something to explore) to patch the packages in the dependency tree to build with a fixed version of openssl, or without openssl, or not build those packages at all.

fanquake · 2024-07-26T13:02:03Z

Can someone confirm if this change is actually still relevant to master? Looking at #30231, after that point, we should only be building OpenSSL 3.x (rather than 3.x & 1.x), in which case, we should be able to remove any instructions about OpenSSL 1.x entirely (a patch could be opened against one of the release branches, where we might still be building 1.x, if relevant). I'm currently doing a no substitutes build to check.

maflcko · 2024-07-26T13:17:59Z

Ah nice, I forgot about 30231.

fanquake · 2024-07-29T09:59:13Z

Can someone confirm if this change is actually still relevant to master?

For all HOSTS except x86_64-w64-mingw32, we currently only build openSSL 3.x. For Windows, via NSIS, we currently depends on Python2 (nsis-x86_64 -> scons-python2 -> python2@2.7.18). This leads to an (indirect) dependency on OpenSSL 1.x and 3.x..

I think the next steps here are to fix NSIS, to use a more recent version of scons (and python3).
Note that Python 3 (since ~3.7) has a hard dependency on OpenSSL (for urllib).

fanquake · 2024-08-01T16:21:34Z

I think the next steps here are to fix NSIS, to use a more recent version of scons (and python3).

Landed a patch upstream to fix this https://git.savannah.gnu.org/cgit/guix.git/commit/?id=d428237642e1e4ac8fda4597205ffec89926c0ec.

Sjors · 2024-08-08T11:46:44Z

Would be quite nice to get rid of openssl-1.1.1 entirely. If the upstream is merged and adopted here, I might nuke my Guix setup to try it.

fanquake · 2024-08-08T12:21:38Z

See #30609.

Sjors · 2024-08-09T13:06:44Z

I partially wiped guix on my (AMD) Ubuntu 24.04 system (sudo rm -rf /root/.cache/guix /var/guix /gnu/store).

$ which guix
/usr/local/bin/guix
$ guix --version
guix (GNU Guix) 1.4.0
$ sudo --login guix pull --commit=efc26826400762207cde9f23802cfe75a737963c

This fails at /gnu/store/bfirgq65ndhf63nn4q6vlkbha9zd931q-openssl-1.1.1l.drv.

After the #30609 bump to --commit=7bf1d7aeaffba15c4f680f93ae88fbef25427252 it still tries to build this OpenSSL version.

So even though Bitcoin Core doesn't need it anymore, Guix itself still does. Unless I did something wrong, which is entirely possible.

maflcko · 2024-08-09T13:19:58Z

So even though Bitcoin Core doesn't need it anymore, Guix itself still does

Would be nice to report this upstream, so that openssl-1.1.1l can be removed, but I guess the removal may not be trivial

Sjors · 2024-08-09T13:23:44Z

This has been open for a few years, but no recent activity: https://issues.guix.gnu.org/56137

Sjors · 2024-08-09T13:42:09Z

Once openssl-1 stuff is gone, we can drop the GnuTLS workaround instructions along with it.

It had a similar problem in 3.6.12, but has been updated to 3.7.2. That was included in the Guix 1.4.0 release in late 2022.

(or I could reword the GnuTLS workaround text to refer to openssl 1)

maflcko · 2024-08-09T13:42:25Z

I presume this will be fixed in guix 1.5, but someone claimed if it isn't already fixed, then it is a bug, see https://mail.gnu.org/archive/html/bug-guix/2023-09/msg00112.html

Sjors · 2024-08-09T13:47:02Z

Interesting, I haven't tried deleting .cache/guix/checkouts as suggested in that thread.

I'm going to wait for guix pull to finish, then take a look at guix graph --type=reverse-package openssl-1.1.1l (reverse-bag?)

maflcko · 2024-08-09T13:50:26Z

There is a good chance that a guix pull will build the current guix first, and then the pulled one, and the reply I linked to is just a wrong guess, but I am not a guix dev, and I don't know if that'd be a bug.

However, if the build isn't fixed with 1.5, then it should be a bug, last time I checked.

Sjors · 2024-08-09T14:28:26Z

That makes sense. I might test that by rebuilding /usr/local/bin/guix from source on a recent master commit, and then try guix pull again. Then we can drop the workaround instruction after 1.5 is released.

Sjors · 2024-08-10T10:57:55Z

@maflcko you theory might somewhat right.

When my /usr/local/bin/guix was at 0.4.0 the first thing it wanted to build was guile-3.0.7.

Now that I built the most recent master commit, it starts out building guile-3.0.9.

However under --list-generations I'm only seeing the version I pulled, not the one I built from source. I then did a guix pull on that commit, which ended up building a few more derivations.

So perhaps it's only building guile or some other code component? cc @theuni

Anyway, I think we should merge the instructions in this PR - and then get rid of this whole timestamp workaround section once 1.5.0 is out.

achow101 · 2024-08-12T19:21:38Z

ACK 8fee535

Going to merge this while we figure out whether openssl 1.x is still required.

8fee535 guix: fix suggested fake date for openssl -1.1.1l (Sjors Provoost) Pull request description: Using `2020-10-01` as the fake timestamp will cause many test failures with `/gnu/store/bfirgq65ndhf63nn4q6vlkbha9zd931q-openssl-1.1.1l.drv`. I didn't investigate why, but I guess because it's _before_ the test certificates were created. They expired in June 2022. I tried a month before that, which worked. Also fixes layout of instructions. ACKs for top commit: achow101: ACK 8fee535 maflcko: review ACK 8fee535 Tree-SHA512: df5dd3aa961e25bd57d0b8b73daeb3ec76856b06e35277f24b6b19be81774512228f75e2b779afa8ea92fcc39beb869f43e0c57fba19ad16a82812e7c0bea38b

b654479 Merge bitcoin#30705: test: Avoid intermittent block download timeout in p2p_ibd_stalling (merge-script) 745a819 Merge bitcoin#30690: devtools, utxo-snapshot: Fix block height out of range in script (Ava Chow) 01b570e Merge bitcoin#29999: guix: fix suggested fake date for openssl-1.1.1l (Ava Chow) 432f352 Merge bitcoin#30580: doc: Add note about distro's `g++-mingw-w64-x86-64-posix` version (merge-script) 1bd090e Merge bitcoin#30597: doc: Drop no longer needed workaround for WSL (merge-script) 8a12237 Merge bitcoin#30630: doc: Update ccache website link (merge-script) f66547f Merge bitcoin#30588: depends: fix ZMQ CMake getcachesize check (merge-script) ddaec96 Merge bitcoin#30565: depends: Fix `zeromq` build on OpenBSD (merge-script) e4e5605 Merge bitcoin#30552: test: fix constructor of msg_tx (merge-script) df3c239 Merge bitcoin#26950: cleanse: switch to SecureZeroMemory for Windows cross-compile (merge-script) 57945ce Merge bitcoin#30506: depends: Cleanup postprocess commands after switching to CMake (merge-script) e016ffa Merge bitcoin#29878: depends: build expat with CMake (merge-script) 62dcd43 Merge bitcoin#29880: depends: build FreeType with CMake (merge-script) 745addf Merge bitcoin#30245: net: Allow -proxy=[::1] on nodes with IPV6 lo only (Ava Chow) 4e144be Merge bitcoin-core/gui#795: Keep focus on "Hide" while ModalOverlay is visible (Hennadii Stepanov) 69c04b2 Merge bitcoin#30372: util: Use SteadyClock in RandAddSeedPerfmon (merge-script) ebed8af Merge bitcoin#30336: depends: update doc in Qt pwd patch (merge-script) 9793fb1 Merge bitcoin#30340: test: Added coverage to Block not found error using gettxoutsetinfo (Ava Chow) 479cb8b Merge bitcoin#30312: contrib: add R(UN)PATH check to ELF symbol-check (merge-script) ca83773 Merge bitcoin#30283: upnp: fix build with miniupnpc 2.2.8 (merge-script) 63e139d Merge bitcoin#30185: guix: show `*_FLAGS` variables in pre-build output (merge-script) 3be0d3e Merge bitcoin#30097: crypto: disable asan for sha256_sse4 with clang and -O0 (merge-script) 3070c3e Merge bitcoin#30078: depends: set AR & RANLIB for CMake (merge-script) Pull request description: ## Issue being fixed or feature implemented Trivial backports ## What was done? ## How Has This Been Tested? built locally ## Breaking Changes ## Checklist: _Go over all the following points, and put an `x` in all the boxes that apply._ - [ ] I have performed a self-review of my own code - [ ] I have commented my code, particularly in hard-to-understand areas - [ ] I have added or updated relevant unit/integration/functional/e2e tests - [ ] I have made corresponding changes to the documentation - [x] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_ ACKs for top commit: UdjinM6: utACK b654479 kwvg: utACK b654479 Tree-SHA512: 10b5af4e92c83fa9d6764b20bf066bba8e4c600402966fd5c1d6dad07b0549d8a42151a33f21e2f8263336c12a810a6f3fc2828d90bc98153e09c165d9e5b043

guix: fix suggested fake date for openssl -1.1.1l

8fee535

Also fix layout of instructions.

DrahtBot added the Build system label Apr 29, 2024

bitcoin deleted a comment Apr 30, 2024

DrahtBot added CI failed and removed CI failed labels Jun 18, 2024

maflcko approved these changes Jul 26, 2024

View reviewed changes

achow101 merged commit 5b0059f into bitcoin:master Aug 12, 2024

Sjors deleted the 2024/04/guix-openssl branch August 13, 2024 07:18

bitcoin locked and limited conversation to collaborators Aug 13, 2025

guix: fix suggested fake date for openssl-1.1.1l #29999

guix: fix suggested fake date for openssl-1.1.1l #29999

Uh oh!

Conversation

Sjors commented Apr 29, 2024

Uh oh!

DrahtBot commented Apr 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage

Reviews

Uh oh!

Sjors commented Apr 29, 2024

Uh oh!

laanwj commented Apr 29, 2024

Uh oh!

Sjors commented Apr 29, 2024

Uh oh!

dongcarl commented Apr 30, 2024

Uh oh!

Sjors commented Apr 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maflcko commented Apr 30, 2024

Uh oh!

maflcko commented Apr 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Sjors commented Apr 30, 2024

Uh oh!

luke-jr commented May 7, 2024

Uh oh!

maflcko left a comment

Choose a reason for hiding this comment

Uh oh!

maflcko Jul 26, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maflcko commented Jul 26, 2024

Uh oh!

fanquake commented Jul 26, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maflcko commented Jul 26, 2024

Uh oh!

fanquake commented Jul 29, 2024

Uh oh!

fanquake commented Aug 1, 2024

Uh oh!

Sjors commented Aug 8, 2024

Uh oh!

fanquake commented Aug 8, 2024

Uh oh!

Sjors commented Aug 9, 2024

Uh oh!

maflcko commented Aug 9, 2024

Uh oh!

Sjors commented Aug 9, 2024

Uh oh!

Sjors commented Aug 9, 2024

Uh oh!

maflcko commented Aug 9, 2024

Uh oh!

Sjors commented Aug 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maflcko commented Aug 9, 2024

Uh oh!

Sjors commented Aug 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Sjors commented Aug 10, 2024

Uh oh!

achow101 commented Aug 12, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

DrahtBot commented Apr 29, 2024 •

edited

Loading

Sjors commented Apr 30, 2024 •

edited

Loading

maflcko commented Apr 30, 2024 •

edited

Loading

maflcko Jul 26, 2024 •

edited

Loading

fanquake commented Jul 26, 2024 •

edited

Loading

Sjors commented Aug 9, 2024 •

edited

Loading

Sjors commented Aug 9, 2024 •

edited

Loading