bug#31825: guix offload fails with guix-authenticate error

[Ludovic Courtès]

Hi Maxim,

Maxim Cournoyer <address@hidden> skribis:

> address@hidden (Ludovic Courtès) writes:
>
>> Hello,
>>
>> Maxim Cournoyer <address@hidden> skribis:
>>
>>> address@hidden ~$ guix offload test
>>> guix offload: testing 1 build machines defined in 
>>> '/etc/guix/machines.scm'...
>>> guix offload: '192.168.1.105' is running guile (GNU Guile) 2.2.3
>>> guix offload: Guix is usable on '192.168.1.105' (test returned 
>>> "/gnu/store/883yjkl46dxw9mzykykmbs0yzwyxm17z-test")
>>> sending 1 store item to '192.168.1.105'...
>>> exporting path `/gnu/store/smgzvgc9krglk0mjpcscg5450l05w4dg-export-test'
>>> guix offload: error: build failed: program `guix-authenticate' failed
>>> with exit code 1
>>
>> On closer inspection, it looks like it may be ‘guix-authenticate’ on
>> “apteryx” that fails.  This could happen if there’s no signing key, for
>> instance, but you said there’s one, so I don’t know.
>>
>> Could you attach strace to guix-daemon on “apteryx” and run “guix
>> offload test” again?
>>
>> Use something like:
>>
>>   # strace -p $(pidof guix-daemon) -f -s 345 -o /tmp/log
>>
>> and then:
>>
>>   # guix offload test
>
> I've ran exactly those commands, and this produced the log attached
> (half a megabyte of text!). I looked at it but I can't seem to see
> what's wrong in there. I hope your trained eyes can see differently!

I don’t see “program `guix-authenticate' failed”, and indeed ‘guix
authenticate’ exits with code 0 (indicating success.)

Are you still getting the error above?

If so it may be that my diagnostic was wrong and that the authentication
failure happens on the other machine.  Could you strace guix-daemon on
that other machine similarly?

However, note that the log ended up containing a copy of your secret
key, /etc/guix/signing-key.sec; sorry for not thinking about this
before.  So once we’re done debugging, you should consider throwing away
that key and re-running “guix archive --generate-key”.  In the next
strace log you send, you might want to remove the private key (look for
an sexp starting with “(private-key …”).

Thanks,
Ludo’.