From patchwork Mon Feb 17 14:35:13 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Morgan Arnold X-Patchwork-Id: 38779 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 2EBCC27BBEA; Mon, 17 Feb 2025 14:36:20 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED, RCVD_IN_VALIDITY_CERTIFIED,RCVD_IN_VALIDITY_RPBL,RCVD_IN_VALIDITY_SAFE, SPF_HELO_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 3B67427BBE2 for ; Mon, 17 Feb 2025 14:36:19 +0000 (GMT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tk2EF-0007Ut-LA; Mon, 17 Feb 2025 09:36:11 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tk2E9-0007U5-Dm for guix-patches@gnu.org; Mon, 17 Feb 2025 09:36:05 -0500 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1tk2E9-00038U-3o for guix-patches@gnu.org; Mon, 17 Feb 2025 09:36:05 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debbugs.gnu.org; s=debbugs-gnu-org; h=MIME-Version:References:In-Reply-To:From:Date:To:Subject; bh=drWhgMRc6fLuGGK5g27afE3jprIjkVBnmhIH9R0H29Y=; b=klfG2oaAOXTNsN5XdKnqJ7DEQkkCkXoV3/wcYXcrdoR9g+LIkCbfdkl2MuUxnsg2nSUkdzzaOme1A0otft7jOR1L1XGD0dqF2By7Ke40foACcdgZFwLiNZo6+kR9JxFVmdE0r19VwJjgnAzE8vh1zwrBPUSE4efAU9FA0BnuO6WJwvQEavryc/6sgRF2gWZgV7feGgb/CfzJ5Pyas4sx8esW5c9Sq7i4R/6/3FNrVyHj9lt4p3izQ1A/Kbcmde0wtrWaIOoAWD+GuTVIxKDhO7j0UZd5mw5Br7ZjskUJfFg4VclTsbq2E8+4KCjimH7cgnK68mD8CmYTdf6/EIdvrw==; Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1tk2E8-0001bF-Sd for guix-patches@gnu.org; Mon, 17 Feb 2025 09:36:04 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#55231] [PATCH v7 4/4] Propagate non-substitutability of derivations. Resent-From: Morgan Arnold Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 17 Feb 2025 14:36:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 55231 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 55231@debbugs.gnu.org Cc: Morgan Arnold , Maxim Cournoyer Received: via spool by 55231-submit@debbugs.gnu.org id=B55231.17398029305999 (code B ref 55231); Mon, 17 Feb 2025 14:36:04 +0000 Received: (at 55231) by debbugs.gnu.org; 17 Feb 2025 14:35:30 +0000 Received: from localhost ([127.0.0.1]:45013 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tk2DY-0001Yc-Tr for submit@debbugs.gnu.org; Mon, 17 Feb 2025 09:35:29 -0500 Received: from mail-40131.protonmail.ch ([185.70.40.131]:58875) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1tk2DU-0001Xm-Ml for 55231@debbugs.gnu.org; Mon, 17 Feb 2025 09:35:25 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=proton.me; s=protonmail; t=1739802916; x=1740062116; bh=drWhgMRc6fLuGGK5g27afE3jprIjkVBnmhIH9R0H29Y=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector:List-Unsubscribe:List-Unsubscribe-Post; b=N1+GrsYvx9krv5dY8u/GlEMytxxgFITNqqrY+Si54kEt0tGmqRvw0tZqVnkshrOL1 YCTpp5eLyoh6yzKBP+giQLETqY4oYdaqLLfZMPtIBIo78qh/DjNogu3MMdcKGYdxwB koeLQu40V55T/ZAsSDeu0nFyu3ujFk675T/L1xFKoQRHEkU4RTnq0QxF3Zc+eAHgK6 XdvnJrgYhkA/Hg6PZZtIJSQB7rY3Gy4K2EHflOR4ssYXIPo6i4N9wb791bWhlKRaNp j6LkaPnPqbBJ38p8TkegebEB9rkRHpsJSbodTy5edLefXzOlQsWYzzXzbAahCvZRBw SI4yn+Zu23T2g== Date: Mon, 17 Feb 2025 14:35:13 +0000 Message-ID: <5b9eb2560f2602e147d7c0d4d9ecf6582b1fe3f3.1739802789.git.morgan.arnold@proton.me> In-Reply-To: References: Feedback-ID: 45510636:user:proton X-Pm-Message-ID: f5f990b964ed6f581408a831e00cb7cee0b52479 MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Morgan Arnold X-ACL-Warn: , Morgan Arnold via Guix-patches X-Patchwork-Original-From: Morgan Arnold via Guix-patches via From: Morgan Arnold Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches This commit changes the conditions under which derivations, as constructed by the `derivation' procedure, are made substitutable, to prevent potential copyright violations related to the construction of substitutable initrds including non-substitutable derivations (in particular, ZFS). This change prevents such copyright violations by only marking a derivation as substitutable if it is itself marked substitutable along all of its inputs. This means that non-substitutable derivations propagate to other derivations using them as input. Change-Id: I80ba4a371ee0c55a1294aff311d4e7b151055fac Signed-off-by: Maxim Cournoyer Modified-by: Maxim Cournoyer --- gnu/system/linux-initrd.scm | 3 +- guix/derivations.scm | 59 +++++++++++++++++++++---------------- tests/derivations.scm | 16 +++++----- 3 files changed, 44 insertions(+), 34 deletions(-) diff --git a/gnu/system/linux-initrd.scm b/gnu/system/linux-initrd.scm index a8df905..98a4c6e 100644 --- a/gnu/system/linux-initrd.scm +++ b/gnu/system/linux-initrd.scm @@ -117,7 +117,8 @@ (define* (expression->initrd exp (file-append (computed-file name builder #:options - `(#:references-graphs (("closure" ,init)))) + `(#:references-graphs (("closure" ,init)) + #:propagating-substitutable? #t)) "/initrd.cpio.gz")) (define (flat-linux-module-directory packages modules) diff --git a/guix/derivations.scm b/guix/derivations.scm index ffa69e9..7682c90 100644 --- a/guix/derivations.scm +++ b/guix/derivations.scm @@ -804,6 +804,7 @@ (define* (derivation store name builder args allowed-references disallowed-references leaked-env-vars local-build? (substitutable? #t) + (propagating-substitutable? #f) (properties '()) (%deprecation-warning? #t)) "Build a derivation with the given arguments, and return the resulting @@ -832,7 +833,9 @@ (define* (derivation store name builder args derivations where the costs of data transfers would outweigh the benefits. When SUBSTITUTABLE? is false, declare that substitutes of the derivation's -output should not be used. +output should not be used. When PROPAGATING-SUBSTITUTABLE? is true, declare +that substitutes of the derivation's output should not be used if any of the +derivation's inputs are not substitutable. PROPERTIES must be an association list describing \"properties\" of the derivation. It is kept as-is, uninterpreted, in the derivation." @@ -868,33 +871,37 @@ (define* (derivation store name builder args env-vars) #f))))) - (define (user+system-env-vars) + (define (user+system-env-vars inputs) ;; Some options are passed to the build daemon via the env. vars of ;; derivations (urgh!). We hide that from our API, but here is the place ;; where we kludgify those options. - (let ((env-vars `(,@(if local-build? - `(("preferLocalBuild" . "1")) - '()) - ,@(if (not substitutable?) - `(("allowSubstitutes" . "0")) - '()) - ,@(if allowed-references - `(("allowedReferences" - . ,(string-join allowed-references))) - '()) - ,@(if disallowed-references - `(("disallowedReferences" - . ,(string-join disallowed-references))) - '()) - ,@(if leaked-env-vars - `(("impureEnvVars" - . ,(string-join leaked-env-vars))) - '()) - ,@(match properties - (() '()) - (lst `(("guix properties" - . ,(object->string properties))))) - ,@env-vars))) + (let* ((substitutable-inputs? (every substitutable-derivation? + (map derivation-input-derivation + inputs))) + (env-vars `(,@(if local-build? + `(("preferLocalBuild" . "1")) + '()) + ,@(if (and substitutable? (or (not propagating-substitutable?) + substitutable-inputs?)) + '() + `(("allowSubstitutes" . "0"))) + ,@(if allowed-references + `(("allowedReferences" + . ,(string-join allowed-references))) + '()) + ,@(if disallowed-references + `(("disallowedReferences" + . ,(string-join disallowed-references))) + '()) + ,@(if leaked-env-vars + `(("impureEnvVars" + . ,(string-join leaked-env-vars))) + '()) + ,@(match properties + (() '()) + (lst `(("guix properties" + . ,(object->string properties))))) + ,@env-vars))) (match references-graphs (((file . path) ...) (let ((value (map (cut string-append <> " " <>) @@ -967,7 +974,7 @@ (define* (derivation store name builder args (filter-map input->derivation-input inputs)) derivation-inputoutput-path drv2)))) + ;; DRV2 is *not* available as a substitute, since it has drv1 as + ;; input, and the non-substitutability is viral to avoid + ;; distributing non-substitutable items that could have become + ;; embedded, for example in an initrd. + (and (null? download) (match build - (((= derivation-file-name build)) - (string=? build (derivation-file-name drv1)))))))))) + (((= derivation-file-name build1) + (= derivation-file-name build2)) + (string=? build1 (derivation-file-name drv1)) + (string=? build2 (derivation-file-name drv2)))))))))) (test-assert "derivation-build-plan and substitutes, local build" (with-store store