This fixes surprising error message like as follows,
which looks like an overlook:

@ unsupported-platform /gnu/store/4xb677bysagk7pl4xba9xz4gzwvsh0zn-guile-bootstrap-2.0.drv x86_64-gnu
while setting up the child process: in phase exec: a `x86_64-gnu' is required to build `x86_64-linux',
 but I am a `/gnu/store/4xb677bysagk7pl4xba9xz4gzwvsh0zn-guile-bootstrap-2.0.drv'

* nix/libstore/build.cc (execBuilderOrBuiltin):
  Fix the error message when canBuildLocally fails.

Fixes: 3af52f845fe2 ("[...] use std::format instead of boost::format.")
Merges: https://codeberg.org/guix/guix/pulls/10080
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>

The prior implementation of 'parse' was, to put it mildly, very accepting of
invalid input.  This made it very difficult to review its security properties,
which ended up relying entirely on the fact that it still didn't allow "/" in
directory entry names and that O_CREAT|O_EXCL implicitly causes symlinks to
not be followed in the final component, and mkdir and symlink never follow
symlinks in the final component, and all of the above throw exceptions when
they fail.

Some examples of what was allowed prior:

1. Empty archives:
   "nix-archive-1" "(" ")"
2. Archives with only a type:
   "nix-archive-1" "(" "type" "regular" ")"
3. Archives of regular files with multiple contents, which would be
   concatenated (e.g. this has contents "foobar"):
   "nix-archive-1" "(" "type" "regular" "contents" "foo" "contents" "bar" ")"
4. Archives of directories with multiple entries with the same name, and that
   aren't sorted:
   "nix-archive-1" "(" "type" "directory"
                       "entry" "(" "name" "c" "node" "(" ")" ")"
                       "entry" "(" "name" "b" "node" "(" ")" ")"
                       "entry" "(" "name" "b" "node" "(" ")" ")"
                       "entry" "(" "name" "a" "node" "(" ")" ")" ")"
5. Archives of directories with empty entries:
   "nix-archive-1" "(" "type" "directory" "entry" "(" ")" ")"
6. Archives of directories with entries with no name:
   "nix-archive-1" "(" "type" "directory" "entry" "(" "node" "(" ")" ")" ")"
7. Archives of directories with entries with no node:
   "nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a" ")" ")"
7. Archives of directories with entries with multiple names:
   "nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a"
                                                      "node" "(" ")"
                                                      "name" "b" ")" ")"
8. Archives of directories with entries with multiple nodes:
   "nix-archive-1" "(" "type" "directory" "entry" "(" "node" "(" ")"
                                                      "node" "(" ")" ")" ")"
9. Archives of directories with entries with multiple names and multiple
   nodes:
   "nix-archive-1" "(" "type" "directory"
                       "entry" "(" "name" "a" "node" "(" ")"
                                   "name" "b" "node" "(" ")" ")" ")"

Such permissiveness rather defeats the "normalized" part of "Normalized
ARchive".

Additionally, 'parse' previously used recursion with no explicit depth limit.
In practice Linux would still limit the depth to around 2048, since filenames
longer than 4096 bytes yield ENAMETOOLONG, but no such restriction exists on
Hurd.

The permissiveness issue is resolved by rewriting 'parse', and the unbounded
recursion issue is resolved by adding a nestLimit parameter so that no more
than DIRECTORY_NESTING_LIMIT (currently 256) levels of recursion are used.  An
alternate implementation that doesn't use recursion, 'parse_unbounded', is
included in case it is determined that the nesting limit should be removed,
but currently only 'parse' is used.

* nix/libutil/archive.cc (parse): rewrite to add nestLimit parameter.
  (parseDump): pass DIRECTORY_NESTING_LIMIT as nestLimit argument to 'parse'.
  (parse_unbounded): new function.

Change-Id: Ia3c32cc645b609f6ae7f3bcafc491ec0073cbb51
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

Specifying all three of -K, --check, --rounds=3 caused valid packages to be
deleted from the store.

When `buildMode == bmCheck`, the built package is not renamed from
`actualPath` to `i.second.path.  Then later, when `settings.keepFailed` and
`curRound < nrRounds`, `i.second.path` was renamed to `i.second.path + "-check"`
anyway.

* nix/libstore/build.cc (DerivationGoal::registerOutputs): Add check for bmCheck
before renaming store path.
* tests/store.scm ("build-things, check mode"): Ensure file is a valid path.
("build-things, check mode + keep-failed"): New test.

Fixes: #9631.
Change-Id: I31d24b2349f563867b8101a1b5ce3c10896ce165
Co-authored-by: Ludovic Courtès <ludo@gnu.org>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #9632

Previously an authorized substitute server could produce invalid store paths -
that is, paths that do denote a top-level file in the store, but that do not
obey the syntax restrictions beyond what that implies.  Given that an
authorized substitute server can already potentially do a lot of damage if it
really wanted to, this isn't a major issue, but closing off this opportunity
does simplify the analysis somewhat.

* nix/libstore/local-store.cc (LocalStore::importPath): use
  strict readStorePath(s) variants.
* tests/store.scm ("import path not in store, unsigned", "import path not in
  store, signed", "import invalid path, unsigned", "import invalid path,
  signed" test cases): new test cases.  The "not in store" cases succeeded
  previously, while the "invalid path" cases did not succeed prior to this
  commit.

Fixes: guix/guix#9078
Change-Id: Ib81c19ec1ae0fff5b7c7268f4f7429b16a870996
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #9434

isStorePath is a lightweight check that only verifies that the given path is
in the store and doesn't have any '/' characters after the store prefix.  This
is insufficiently strict for verifying that a given path is actually a valid
store path.

isStoreName is extracted from checkStoreName, and to preserve the error
messages may have a second argument giving a string to write to with the
problem description in the case that isStoreName returns false.

* nix/libstore/store-api.hh (assertStorePathStrict, isStoreName,
  isStoreBasenameStrict, isStorePathStrict): new functions.
* nix/libstore/worker-protocol.hh (readStorePathStrict): new function.
  (readStorePathsStrict): new template.
* nix/libstore/store-api.cc (assertStorePathStrict, isStoreName,
  isStoreBasenameStrict, isStorePathStrict, readStorePathStrict,
  readStorePathsStrict): provide implementations.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>

* nix/libutil/hash.hh (isHash32): new function.
* nix/libutil/hash.hh (isHash32): provide implementation.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>

Recognizing base32 characters and/or parsing them into byte sequences is done
in several places, so it makes sense to provide a common lookup table.

* nix/libutil/hash.hh (base32Values, base32ValuesInitialized): new variables.
  (initializeBase32Values, getBase32Value): new functions.
* nix/libutil/hash.cc (base32Values, base32ValuesInitialized): provide
  definition for variables.
  (initializeBase32Values, getBase32Value): provide function implementations.
  (parseHash32): use base32Values.
* nix/libstore/references.cc (search): use base32Values.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>

Config files like /etc/services may be symbolic links to files not available
in the build environment; copy them instead of creating dangling symlinks.

This also reverts 425aa1bf7c35839f5e500515ff3b5a861a7533d6, which would
potentially create dangling symlinks in the chroot, as reported by @cnx in
guix/guix#9072.

* nix/libstore/build.cc (DerivationGoal::startBuilder): copy network config
  files.

Fixes: guix/guix#4225
Change-Id: I38fc6374c5cecdcd16de06161db00b3825688f2a
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>

Docker's default seccomp filter prevents use of the ADDR_NO_RANDOMIZE flag
with the personality system call.  It causes personality to return EPERM.  In
general, we assume that any result other than the only documented one, EINVAL,
is caused by seccomp.  If we detect that ADDR_NO_RANDOMIZE is blocked, and the
--allow-aslr option was passed, we simply don't use it.

This allows guix-daemon to continue to work even in these containers, without
any implicit weakening of reproducibility.

Since it is presumably desirable to be able to build guix itself in such an
environment, also pass --allow-aslr to guix-daemon in test-env.

* nix/libstore/globals.hh (Settings::allowASLR): new field.
* nix/nix-daemon/guix-daemon.cc (options): add --allow-aslr option.
  (parse_opt): use it to set Settings::allowASLR.
* nix/libstore/build.cc (DerivationGoal::startBuilder): detect when
  ADDR_NO_RANDOMIZE is blocked and --allow-aslr is passed and don't use it in
  that case.
* doc/guix.texi: document --allow-aslr in "Invoking guix-daemon".
* build-aux/test-env.in: always pass --allow-aslr.

Fixes: guix/guix#3917
Change-Id: I51c5899a9559e161f9e107c2e6a36df395ab3134
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>
Merges: #4616

* doc/local.mk (lang_to_texinfo): Refer to .texi files using srcdir.
(xref_command): Reference pre-inst-env using builddir.
($(srcdir)/%D%/guix.%.texi):
($(srcdir)/%D%/guix-cookbook.%.texi):
($(srcdir)/%D%/contributing.%.texi): Refer to source files using srcdir.
* nix/local.mk (etc/guix-gc.timer): Use the name of the prerequisite,
not just its file name.

Change-Id: I247bcd873c8355d0eae07870ec849d2eb8cfa6c5
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #8267