bug#26948: gnutls errors on multiple guix commands

[Maxim Cournoyer]

Mark H Weaver <address@hidden> writes:

> address@hidden (Ludovic Courtès) writes:
>
>> Hi Maxim,
>>
>> Maxim Cournoyer <address@hidden> skribis:
>>
>>> It seems that the problem is caused by the file:
>>> "/etc/ssl/certs/AC_Ra\303\255z_Certic\303\241mara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.p".
>
> This reminds me of a bug that I found in the Guile binding in GnuTLS a
> while ago, but forgot to report.  Maybe it's related:
>
> In 'set_certificate_file' in gnutls-3.5.9/guile/src/core.c:
>
>   static unsigned int
>   set_certificate_file (certificate_set_file_function_t set_file,
>                         SCM cred, SCM file, SCM format, const char *func_name)
>   #define FUNC_NAME func_name
>   {
>     int err;
>     char *c_file;
>     size_t c_file_len;
>   
>     gnutls_certificate_credentials_t c_cred;
>     gnutls_x509_crt_fmt_t c_format;
>   
>     c_cred = scm_to_gnutls_certificate_credentials (cred, 1, FUNC_NAME);
>     SCM_VALIDATE_STRING (2, file);
>     c_format = scm_to_gnutls_x509_certificate_format (format, 3, FUNC_NAME);
>   
>     c_file_len = scm_c_string_length (file);
>     c_file = alloca (c_file_len + 1);
>   
>     (void) scm_to_locale_stringbuf (file, c_file, c_file_len + 1);
>     c_file[c_file_len] = '\0';
>   
>     err = set_file (c_cred, c_file, c_format);
>     if (EXPECT_FALSE (err < 0))
>       scm_gnutls_error (err, FUNC_NAME);
>   
>     /* Return the number of certificates processed.  */
>     return ((unsigned int) err);
>   }
>
> 'scm_c_string_length' is inappropriately assumed to return the length
> of the encoded C string in bytes, whereas it actually returns the
> number of characters (code points).
>
> This led to:
>
> stat("/etc/ssl/certs/AC_Ra\303\255z_Certic\303\241mara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem",
>  {st_mode=S_IFREG|0444, st_size=2444, ...}) = 0
> open("/etc/ssl/certs/AC_Ra\303\255z_Certic\303\241mara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.p",
>  O_RDONLY) = -1 ENOENT (No such file or directory)
>
> While doing this:
>
> address@hidden ~$ strace -o trace.out guix import gem rails
> Backtrace:
> In unknown file:
>    ?: 19 [apply-smob/1 #<catch-closure 2793e20>]
> In ice-9/boot-9.scm:
>   66: 18 [call-with-prompt prompt0 ...]
> In ice-9/eval.scm:
>  432: 17 [eval # #]
> In ice-9/boot-9.scm:
> 2412: 16 [save-module-excursion #<procedure 27b4900 at 
> ice-9/boot-9.scm:4084:3 ()>]
> 4089: 15 [#<procedure 27b4900 at ice-9/boot-9.scm:4084:3 ()>]
> 1734: 14 [%start-stack load-stack ...]
> 1739: 13 [#<procedure 27c6b40 ()>]
> In unknown file:
>    ?: 12 [primitive-load "/home/mhw/guix/scripts/guix"]
> In guix/ui.scm:
> 1255: 11 [run-guix-command import "gem" "rails"]
> In guix/scripts/import.scm:
>  114: 10 [guix-import "gem" "rails"]
> In guix/scripts/import/gem.scm:
>   84: 9 [guix-import-gem "rails"]
> In guix/import/gem.scm:
>  121: 8 [gem->guix-package "rails" #f]
> In ice-9/boot-9.scm:
>  160: 7 [catch srfi-34 #<procedure 3518440 at guix/import/json.scm:29:2 ()> 
> ...]
> In guix/import/json.scm:
>   32: 6 [#<procedure 3518440 at guix/import/json.scm:29:2 ()>]
> In guix/http-client.scm:
>  239: 5 [loop #]
> In guix/build/download.scm:
>  520: 4 [open-connection-for-uri # # #f ...]
>  391: 3 [tls-wrap #<input-output: socket 10> "rubygems.org" ...]
>  308: 2 [make-credendials-with-ca-trust-files "/etc/ssl/certs"]
> In srfi/srfi-1.scm:
>  616: 1 [for-each #<procedure 351f090 at guix/build/download.scm:308:14 
> (file)> #]
> In unknown file:
>    ?: 0 [set-certificate-credentials-x509-trust-file! # ...]
>
> ERROR: In procedure set-certificate-credentials-x509-trust-file!:
> ERROR: Throw to key `gnutls-error' with args `(#<gnutls-error-enum Error 
> while reading file.> set-certificate-credentials-x509-trust-file!)'.
> address@hidden ~$
>
> The problem can be worked around by using the C locale:
>
> address@hidden ~$ LC_ALL=C guix import gem rails
> (package
>   (name "ruby-rails")
>   (version "5.1.0")
>   (source
>     (origin
>       (method url-fetch)
>       (uri (rubygems-uri "rails" version))
>       (sha256
>         (base32
>           "0cpcnrlqg1am2jfdz6pf9snh89qzbny9ikbpg3xz31qrqv9f4hyq"))))
>   (build-system ruby-build-system)
>   (propagated-inputs
>     `(("ruby-actioncable" ,ruby-actioncable)
>       ("ruby-actionmailer" ,ruby-actionmailer)
>       ("ruby-actionpack" ,ruby-actionpack)
>       ("ruby-actionview" ,ruby-actionview)
>       ("ruby-activejob" ,ruby-activejob)
>       ("ruby-activemodel" ,ruby-activemodel)
>       ("ruby-activerecord" ,ruby-activerecord)
>       ("ruby-activesupport" ,ruby-activesupport)
>       ("bundler" ,bundler)
>       ("ruby-railties" ,ruby-railties)
>       ("ruby-sprockets-rails" ,ruby-sprockets-rails)))
>   (synopsis
>     "Ruby on Rails is a full-stack web framework optimized for programmer 
> happiness and sustainable productivity. It encourages beautiful code by 
> favoring convention over configuration.")
>   (description
>     "Ruby on Rails is a full-stack web framework optimized for programmer 
> happiness and sustainable productivity.  It encourages beautiful code by 
> favoring convention over configuration.")
>   (home-page "http://rubyonrails.org";)
>   (license license:expat))
> address@hidden ~$ 

This is it! Setting "LC_ALL=C" works around the problem. Thanks for
chipping in. I've investigated on the Guile side and isolated the
problem to be with the file name only, which corroborates your finding:

--8<---------------cut here---------------start------------->8---
(use-modules (ice-9 ftw)
             (gnutls))

(define ffile 
"/etc/ssl/certs/AC_Raíz_Certicámara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem")

;; Simply copied to my home dir.
(define ffile-2 
"/home/maxim/AC_Raíz_Certicámara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem")

;; s/í/i/ & s/á/a/
(define ffile-3 
"/home/maxim/AC_Raiz_Certicamara_S.A.:2.15.7.126.82.147.123.224.21.227.87.240.105.140.203.236.12.pem")

(define cred (make-certificate-credentials))

(set-certificate-credentials-x509-trust-file! cred ffile-2
                                              x509-certificate-format/pem)
;; => ERROR: Throw to key `gnutls-error' with args `(#<gnutls-error-enum Error 
while reading file.> set-certificate-credentials-x509-trust-file!)'.


(set-certificate-credentials-x509-trust-file! cred ffile-2
                                              x509-certificate-format/pem)
;; => ERROR: Throw to key `gnutls-error' with args `(#<gnutls-error-enum Error 
while reading file.> set-certificate-credentials-x509-trust-file!)'.

(set-certificate-credentials-x509-trust-file! cred ffile-3
                                              x509-certificate-format/pem)
;; => 1
--8<---------------cut here---------------end--------------->8---

Maxim