guix/tests, branch r-team

build/node: Preserve field order of modified JSON files.

2026-07-08T16:33:27+00:00

* guix/build/node-build-system.scm (with-atomic-json-file-replacement): Call
json->scm with #:ordered #t.
* tests/node.scm ("modify-json, ordering"): New test.
("delete-dev-dependencies/except"): Adjust expected output accordingly.

Change-Id: I9cf0475a7bac0cad8f5fd3d479c50eb35eac3f32

build/node: Add `delete-dependencies/except' procedure.

2026-07-08T16:33:27+00:00

This adds a more convenient means to filter out most, but not all, development
dependencies.

* guix/build/node-build-system.scm (%dependency-keys)
(%dev-dependency-keys): New variables.
(delete-dependencies) [#:negate?, #:dependency-keys]: New arguments.  Log
removed dependencies.
(delete-dependencies/except, delete-dev-dependencies/except): New procedures.
* tests/node.scm: New test.
* Makefile.am (SCM_TESTS): Register it.

tests: git: Avoid duplicated helper code.

2026-07-06T10:00:49+00:00

* tests/git.scm (git): New procedure.
("update-cached-checkout, tag",
"update-cached-checkout, recursive submodules follow ref",
"update-cached-checkout, symref tag",
"update-cached-checkout, symref pull-request"): Use it.

Change-Id: I85aa14e729be1efe691418e74e37d6ae1fd3e633

tests: git: Avoid nested checks for submodules.

2026-07-06T10:00:25+00:00

Follow up of 8d27b1158de3cc1823d33847cb722722c769a27e discussed in #9231.

* tests/git.scm ("update-cached-checkout, recursive submodules follow ref"):
Replace the nested 'let' by 'let*'.

Merges: #9683
Change-Id: Ibd212bbd2b6fbf02f6fcae0ecb21922686b5f8bc

scripts: substitute: Accommodate renaming unwritable directories.

2026-07-05T09:47:15+00:00

This fixes a regression introduced in 26d7eb8a4adafc648ef035e91b6bbc4945d4c962
when running ‘guix-daemon’ without root privileges.

On rootless installations, we must abide by the usual file access rules, which
include the requirement that a directory be writable before it be renamed (the
rationale being that its ".." entry needs to be modified).

* guix/scripts/substitute.scm (rename-file*): New procedure.
(guix-substitute): Use it.
* tests/substitute.scm (directory-nar-sha256): New procedure.
(%narinfo/directory): New variable.
(call-with-narinfo): Add '#:directory?' keyword argument.
(with-directory-narinfo): New syntax.
("substitute, authorized key, directory"): New test case.

Fixes: guix/guix#9686
Change-Id: I9d399dd5f1717b7d02854d97e1100a0a464fac75
Signed-off-by: Ludovic Courtès 
Merges: #9702

profiles: Add manifest generator based on build-system.

2026-07-03T13:10:29+00:00

* guix/profiles.scm (build-system->manifest): New procedure.
* doc/guix.texi (Writing Manifests): Document it.
* tests/profiles.scm: Test it.

Merges: #7272
Change-Id: Iaba54d5d4a1a9ae304de45f91374098617adebfc
Signed-off-by: Simon Tournier

substitutes: Ignore narinfos that don’t match the request [security fix].

2026-07-02T17:42:48+00:00

Previously, by serving a valid, signed, and authorized narinfo that does not
match what the client asked for, an attacker could cause users to get the
wrong substitute.

* guix/substitutes.scm (fetch-narinfos)[handle-narinfo-response]: Check
whether the result of ‘read-narinfo’ matches ‘request’ and ignore it if it
doesn’t.
[do-fetch]: Likewise with ‘narinfo-from-file’.
* tests/substitute.scm ("query narinfo that returns different store path")
("substitute, narinfo does not match requested store item"): New tests.

Reported-by: Reepca Russelstein 
Signed-off-by: Ludovic Courtès 
Merges: #9665

tests: challenge: produce narinfo StorePath with proper hash length.

2026-07-02T17:42:48+00:00

Recent changes caused (guix narinfo) to start validating the StorePath of all
narinfos, which is what finally caught this.

* tests/challenge.scm (call-mismatch-test): produce an item path whose hash
  has 32 nix-base32 characters, rather than 32 bytes.

Change-Id: I19a5c0106c913d9ad37fb53a28e8add8bd6ec2a0
Signed-off-by: Ludovic Courtès

narinfo: Reject narinfos where store file names are invalid.

2026-07-02T17:42:48+00:00

This change safeguards against narinfos that would advertise
“StorePath: /gnu/store/…-foo/../../../etc/passwd” or similar, which could
otherwise propagate down the line and lead to attempts to overwrite said file,
should ‘guix-daemon’ be running as root.

* guix/narinfo.scm (narinfo-maker): Validate ‘path’, ‘references’, and
‘deriver’ and return #f upon failure.
(read-narinfo, string->narinfo): Adjust docstring accordingly.
* guix/substitutes.scm (fetch-narinfos): Remove check for ‘narinfo-path’
prefix; instead check whether ‘read-narinfo’ returned true.
(cached-narinfo): Check whether ‘string->narinfo’ returned true.
* tests/substitute.scm ("query narinfo that contains invalid store path"): New
test.

Change-Id: I0be2ea88b7f762144fca35373363364df3264b5a
Signed-off-by: Ludovic Courtès

tests: Fix improper narinfo ‘Deriver’ and ‘References’ field values.

2026-07-02T17:42:47+00:00

The mistake was harmless because the ‘Deriver’ and ‘References’ field values
were unchecked so far.

* tests/substitute.scm (%narinfo)
("query narinfo with signature over irrelevant bits")
("query narinfo with signature over relevant subset")
("substitute, invalid hash")
("substitute, two invalid narinfos"): Remove store prefix from ‘Deriver’ field
value.  Add hash part to ‘Deriver’ and ‘References’ values.
* tests/guix-daemon.sh: Likewise.

Change-Id: I0af4b9aa4b64cebf46d221ffab17bf5663b0cc11
Signed-off-by: Ludovic Courtès