v27.2 guix build fails with hash mismatch #31266

Is there an existing issue for this?

• I have searched the existing issues

Current behaviour

git checkout v27.2
./contrib/guix/guix-build
...

This fails for gnutls-3.8.1.tar.xz.drv, so I run that one specifically:

$ guix build --cores=1 /gnu/store/b0cvv1d3kz4ilf14iz5b9iq4dafxcv4a-gnutls-3.8.1.tar.xz.drv
The following derivation will be built:
  /gnu/store/b0cvv1d3kz4ilf14iz5b9iq4dafxcv4a-gnutls-3.8.1.tar.xz.drv
building /gnu/store/b0cvv1d3kz4ilf14iz5b9iq4dafxcv4a-gnutls-3.8.1.tar.xz.drv...

Starting download of /gnu/store/rfq2b86kacgk0aslndpawk8gq912n9xj-gnutls-3.8.1.tar.xz
From http://artfiles.org/gnupg.org/gnutls/v3.8/gnutls-3.8.1.tar.xz...
download failed "http://artfiles.org/gnupg.org/gnutls/v3.8/gnutls-3.8.1.tar.xz" 404 "Not Found"

Starting download of /gnu/store/rfq2b86kacgk0aslndpawk8gq912n9xj-gnutls-3.8.1.tar.xz
From http://www.crysys.hu/gnutls/v3.8/gnutls-3.8.1.tar.xz...
following redirection to `https://www.crysys.hu/gnutls/v3.8/gnutls-3.8.1.tar.xz'...
downloading from http://www.crysys.hu/gnutls/v3.8/gnutls-3.8.1.tar.xz ...
 gnutls-3.8.1.tar.xz  2KiB                                                                                        5.7MiB/s 00:00 ▕██████████████████▏ 100.0%
sha256 hash mismatch for /gnu/store/rfq2b86kacgk0aslndpawk8gq912n9xj-gnutls-3.8.1.tar.xz:
  expected hash: 1742jiigwsfhx7nj5rz7dwqr8d46npsph6b68j7siar0mqarx2xs
  actual hash:   1jp7wmciqz9cmxvcqfn8lf2c0p8w6xp9xjrvk1z9lq0faswk2102
hash mismatch for store item '/gnu/store/rfq2b86kacgk0aslndpawk8gq912n9xj-gnutls-3.8.1.tar.xz'
build of /gnu/store/b0cvv1d3kz4ilf14iz5b9iq4dafxcv4a-gnutls-3.8.1.tar.xz.drv failed
View build log at '/var/log/guix/drvs/b0/cvv1d3kz4ilf14iz5b9iq4dafxcv4a-gnutls-3.8.1.tar.xz.drv.gz'.
guix build: error: build of `/gnu/store/b0cvv1d3kz4ilf14iz5b9iq4dafxcv4a-gnutls-3.8.1.tar.xz.drv' failed

Strange since there are quite a few v27.2 signatures: https://github.com/bitcoin-core/guix.sigs/tree/main/27.2

So if it's an upstream issue, it must be very recent.

I have substitutes disabled.

Expected behaviour

Guix build to succeed.

Steps to reproduce

...

Relevant log output

No response

How did you obtain Bitcoin Core

Compiled from source

What version of Bitcoin Core are you using?

v27.2

Operating system and version

Ubuntu 24.10 (x86_64)

Machine specifications

No response

sha256 hash mismatch for /gnu/store/rfq2b86kacgk0aslndpawk8gq912n9xj-gnutls-3.8.1.tar.xz: expected hash: 1742jiigwsfhx7nj5rz7dwqr8d46npsph6b68j7siar0mqarx2xs actual hash: 1jp7wmciqz9cmxvcqfn8lf2c0p8w6xp9xjrvk1z9lq0faswk2102

I'd say this is an upstream issue (of guix and gnutls). It would be good to notify either, or both. Also, it would be good to preserve the file, and compare it with the previous one.

gnutls-3.8.1.tar.xz 2KiB

I'm guessing you got redirected to a bad mirror (or one what has since removed this file etc), and have downloaded a 404 page. The actual tarball should be 6mb. What happens if you retry until you hit a different mirror?

Strange since there are quite a few v27.2 signatures: https://github.com/bitcoin-core/guix.sigs/tree/main/27.2

Those builders could have had this package built & saved on disk from when 27.0 was released in April.

I ended up working around the issue by downloading the file elsewhere:

guix download https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.1.tar.xz

After that guix build is happy.

My guess is that .xy files have been purged from the internet left and right. Not sure if this is worth filing an upstream issue.

I was able to do a complete guix build for v27.2: https://github.com/bitcoin-core/guix.sigs/pull/1433

Noticed while setting up an new guix environment for #31323 that I needed a few more (starting at 1.4.0 installed on Ubuntu in a VM):

guix download https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.2.tar.xz
guix download https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.8.8.tar.bz2
guix download https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.42.tar.bz2

(will add more here if needed, still building)

This could be a problem... I can't find net-tools-1.60-0.479bb4a.zip.drv anywhere on the internet, so I had to copy it from my other guix machine instead.

So the problem may not be limited to backport releases like v27.2

I broke my guix (virtual) machine, so did another fresh install, in order to build master @ bb92bb36f211b88e4c1aa031a4364795cbd24767. The host is an M4 MacBook Pro running Ubuntu 24.10 via UTM (qemu). Guix 1.4.0 was installed via apt.

I then manually pulled the current commit we're using:

guix pull --commit=53396a22afc04536ddf75d8f82ad2eafa5082725 --no-substitutes

As above I had to download gnutls-3.7.2.tar.xz (I also downloaded the other two packages there, but didn't check if they were used).

We should probably document the download workaround.

I nuked Guix again and did a pull to see which exact packages need to be downloaded:

guix download https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.2.tar.xz
guix download https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.7.tar.xz
guix download https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.3.tar.xz
guix download https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.8.8.tar.bz2
guix download https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.10.1.tar.bz2
guix download https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.42.tar.bz2
guix download https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.45.tar.bz2
guix download https://deac-riga.dl.sourceforge.net/project/boost/boost/1.80.0/boost_1_80_0.tar.bz2

I also still needed the (already documented) openssl-1.1.1l test date workaround.

The following packages failed the first time, but were fine after a manual restart (with --cores=1):

guix build /gnu/store/fslpy0jb96rhi6vxbzb54jijan2m1nrv-gettext-minimal-0.21.drv --cores=1 --no-substitutes
guix build /gnu/store/q07c1iji9pn3hwgbzc09812y2i6zgakp-gettext-minimal-0.21.drv --cores=1 --no-substitutes
guix build /gnu/store/2hhv8ri2vqjjf5rqq3vhg2niayz3l61x-gcc-toolchain-11.3.0.drv --cores=1 --no-substitutes
guix build /gnu/store/rhrx4qax94pbv94aqpx4sqn3470byz16-guile-gcrypt-0.4.0.drv  --cores=1 --no-substitutes
guix build /gnu/store/n48jvh0f3xpwkf7m7lycqx12g6qhb6zd-guile-bytestructures-1.0.10.drv --cores=1 --no-substitutes
guix build /gnu/store/24raacjxgf0m9yvwr5fv5a1vvrcyzhs9-automake-1.16.5.drv --cores=1 --no-substitutes
guix build /gnu/store/lv6f18a1ai6s8fm3gia50c8br1f6mrxz-tcl-8.6.12.drv --cores=1 --no-substitutes
...
/gnu/store/cwi6r9wjml8wwsr86ma1b3cgdal8l2y8-graphviz-minimal-7.0.1.drv

For automake I ran into the same "FAIL t/subobj.sh" issue as here https://github.com/monero-project/monero/issues/9900. IIUC there was a proposal to skip them: https://lists.nongnu.org/archive/html/guix-commits/2025-01/msg03539.html (unclear to me if it got merged)

And then for the Bitcoin Core build, I just needed the app armor fix here.

Same here:

building /gnu/store/z3s5wmdqmbznsh7i1wvs0y9lw7zmqw1w-gnutls-3.7.7.tar.xz.drv...


Starting download of /gnu/store/sziaihhn2rs2p95gfn83yi78b9dlj2qi-gnutls-3.7.7.tar.xz
From http://artfiles.org/gnupg.org/gnutls/v3.7/gnutls-3.7.7.tar.xz...
download failed "http://artfiles.org/gnupg.org/gnutls/v3.7/gnutls-3.7.7.tar.xz" 404 "Not Found"

Starting download of /gnu/store/sziaihhn2rs2p95gfn83yi78b9dlj2qi-gnutls-3.7.7.tar.xz
From http://www.crysys.hu/gnutls/v3.7/gnutls-3.7.7.tar.xz...
following redirection to `https://www.crysys.hu/gnutls/v3.7/gnutls-3.7.7.tar.xz'...
@ download-started /gnu/store/sziaihhn2rs2p95gfn83yi78b9dlj2qi-gnutls-3.7.7.tar.xz http://www.crysys.hu/gnutls/v3.7/gnutls-3.7.7.tar.xz 1904
@ download-progress /gnu/store/sziaihhn2rs2p95gfn83yi78b9dlj2qi-gnutls-3.7.7.tar.xz http://www.crysys.hu/gnutls/v3.7/gnutls-3.7.7.tar.xz 1904 1904
@ download-progress /gnu/store/sziaihhn2rs2p95gfn83yi78b9dlj2qi-gnutls-3.7.7.tar.xz http://www.crysys.hu/gnutls/v3.7/gnutls-3.7.7.tar.xz 1904 1904
@ download-succeeded /gnu/store/sziaihhn2rs2p95gfn83yi78b9dlj2qi-gnutls-3.7.7.tar.xz http://www.crysys.hu/gnutls/v3.7/gnutls-3.7.7.tar.xz 1904


-sha256 hash mismatch for /gnu/store/sziaihhn2rs2p95gfn83yi78b9dlj2qi-gnutls-3.7.7.tar.xz:
  expected hash: 01i1gl15k6qwvxmxx0by1mn9nlmcmym18wdpm7dn9awfsp8474dy
  actual hash:   0xrdl7yj012cm00d1a0gnb0qmgclpd555ym79j4p1h49xdqrpriq
hash mismatch for store item '/gnu/store/sziaihhn2rs2p95gfn83yi78b9dlj2qi-gnutls-3.7.7.tar.xz'

Your suggestion guix download https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.7.tar.xz from above works around it.

This is already fixed upstream in https://codeberg.org/guix/guix/commit/a9c33e9f688fce88aed610ab04c650efb71b4ce6.

So this issue will fix itself on the next time machine bump

This issue is being closed because it falls outside the scope of this repository.

This issue is being closed because it falls outside the scope of this repository.

Not sure this is fully true, but this will be fixed by the next time-machine bump. C.f. https://github.com/bitcoin/bitcoin/pull/33185

I think it was a cryptic reference to the fact that v27 is end-of-maintenance, but these type of errors still happen, at least until the next time-machine bump.