bug#44623: closed ([PATCH] archive: Warn about replacing an ACL symlink.)

[GNU bug Tracking System]

Your message dated Sun, 15 Nov 2020 23:06:16 +0100
with message-id <87zh3iwa07.fsf@nckx>
and subject line Re: [bug#44623] [PATCH] archive: Warn about replacing an ACL 
symlink.
has caused the debbugs.gnu.org bug report #44623,
regarding [PATCH] archive: Warn about replacing an ACL symlink.
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs@gnu.org.)


-- 
44623: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=44623
GNU Bug Tracking System
Contact help-debbugs@gnu.org with problems
> --- Begin Message ---
>
>
>
> Subject: 
>
> [PATCH] archive: Warn about replacing an ACL symlink.
>
>
>
>
> Date: 
>
> Fri, 13 Nov 2020 21:20:41 +0100
>
>
>
>
> * guix/scripts/archive.scm (authorize-key): Warn when %ACL-FILE is a
> symbolic link and print an additional hint for Guix System users.
> ---
>  guix/scripts/archive.scm | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/guix/scripts/archive.scm b/guix/scripts/archive.scm
> index 02557ce454..d284196f41 100644
> --- a/guix/scripts/archive.scm
> +++ b/guix/scripts/archive.scm
> @@ -1,5 +1,6 @@
>  ;;; GNU Guix --- Functional package management for GNU
>  ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2019, 2020 Ludovic Courtès 
> <ludo@gnu.org>
> +;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -310,6 +311,16 @@ the input port."
>          (leave (G_ "failed to read public key: ~a: ~a~%")
>                 (error-source err) (error-string err)))))
>  
> +  ;; Warn about potentially volatile ACLs, but continue: system reconfiguration
> +  ;; might not be possible without (newly-authorized) substitutes.
> +  (when (and (access? %acl-file F_OK)
> +             (eq? 'symlink (stat:type (lstat %acl-file))))
> +    (warning (G_ "replacing symbolic link ~a with a regular file~%")
> +             %acl-file)
> +    (when (string-prefix? (%store-prefix) (readlink %acl-file))
> +      (display-hint (G_ "On Guix System, add public keys to the
> +@code{authorized-keys} field of your @code{operating-system} instead."))))
> +
>    (let ((key (read-key))
>          (acl (current-acl)))
>      (unless (eq? 'public-key (canonical-sexp-nth-data key 0))
> -- 
> 2.29.2
>
>
>
>
> --- End Message ---

--- Begin Message --- Subject: Re: [bug#44623] [PATCH] archive: Warn about replacing an ACL symlink. Date: Sun, 15 Nov 2020 23:06:16 +0100

Ludovic Courtès 写道：

Tobias Geerinckx-Rice <me@tobias.gr> skribis:

* guix/scripts/archive.scm (authorize-key): Warn when %ACL-FILE is a symbolic link and print an additional hint for Guix System users.

Oh, I was convinced that ‘guix archive --authorize’ would now fail on Guix System, but indeed it doesn’t, due to the canonical rename trick.

I don't want it to fail.

Just today I used ‘guix archive --authorize’ so ‘guix system reconfigure’ (to add the key!) wouldn't take all day. Killer feature!

You can do both at once (thus avoiding a TOCTTOU race) with:

That is significantly better. Pushed as 5d15733c426d232e98098d99a5bfe145586609a4.

Thank you!

T G-R

signature.asc
Description: PGP signature

--- End Message ---