bug#69868: Source downloads result in suspicious ownership or permission

When building any package with "--no-substitutes" then it seems like something is going wrong with the download process:

--8<---------------cut here---------------start------------->8---
~ ❯ guix build curl --no-substitutes --checkThe following derivations will be built:
  /gnu/store/3q7mxdpdxm6bvyq5w1sh362q7697gd2s-curl-8.5.0.drv
  /gnu/store/4kzkf7rh9cq7w9k1c94ckf1vp3rm0wgi-nghttp2-1.58.0.drv
  /gnu/store/20qgb2k47a3s2k9bf7ind1cakikfm1zh-cunit-2.1-3.drv
  /gnu/store/2qi0vn57s069bcycf5wm6zmkww67g9jj-CUnit-2.1-3.tar.bz2.drv
  /gnu/store/dhmxlz3h44vgmjxcz99gfz5vcfrx5ksj-libtool-2.4.7.drv
  /gnu/store/1fhpr3wk3bqj4n0q91jb8avacj7qdmwb-libtool-2.4.7.tar.xz.drv
  /gnu/store/awmf26axvaslrz0h3q4bgqxcal9gj4p1-libtool-2.4.7.tar.xz.drv
  /gnu/store/1n53f4wa06bmjzsg8v274b6bnbfvkjbb-help2man-1.49.2.drv
  /gnu/store/dhw1w73snd0113f1w1b3jz65z4icy9bs-help2man-1.49.2.tar.xz.drv
  /gnu/store/fzby2mc83zr4bz5pj7xpr6s6ssk0v1c3-autoconf-wrapper-2.69.drv
  /gnu/store/g36xhgg7b96n6j9w2frhs8v81irwnw1a-autoconf-2.69.tar.xz.drv
  /gnu/store/i9cdr2n05xmq3lb9x6la216h0bjwn0f9-autoconf-2.69.drv
  /gnu/store/vmcdkihxgqljdw9i27ghfk2nxfdcbcm7-automake-1.16.5.drv
  /gnu/store/b7h3khilnc1hvr384kypqib16b76vjhp-automake-1.16.5.tar.xz.drv
  /gnu/store/j0kp2928ymdc0q6mykxvbnprwv3bb2xp-automake-1.16.5.tar.xz.drv
  /gnu/store/41kis73i2023bycca22jcbpw1jchdy2a-nghttp2-1.58.0.tar.xz.drv
  /gnu/store/z2ny4vkwyj6zkzk49xmv9vv7ycvgjqa0-curl-8.5.0.tar.xz.drv
  /gnu/store/85j4lw0jz28axfjgp5k3r5zy440710wq-curl-8.5.0.tar.xz.drv
building /gnu/store/85j4lw0jz28axfjgp5k3r5zy440710wq-curl-8.5.0.tar.xz.drv...

Starting download of /gnu/store/9i4hzqsjwmjg3wir3q1hk0mxgxh2hrgz-curl-8.5.0.tar.xz
From https://curl.se/download/curl-8.5.0.tar.xz...
downloading from https://curl.se/download/curl-8.5.0.tar.xz ...
 curl-8.5.0.tar.xz  2.5MiB                             9.0MiB/s 00:00 ▕██████████████████▏ 100.0%
suspicious ownership or permission on `/gnu/store/9i4hzqsjwmjg3wir3q1hk0mxgxh2hrgz-curl-8.5.0.tar.xz'; rejecting this build output
build of /gnu/store/85j4lw0jz28axfjgp5k3r5zy440710wq-curl-8.5.0.tar.xz.drv failed
View build log at '/var/log/guix/drvs/85/j4lw0jz28axfjgp5k3r5zy440710wq-curl-8.5.0.tar.xz.drv.gz'.
building /gnu/store/2qi0vn57s069bcycf5wm6zmkww67g9jj-CUnit-2.1-3.tar.bz2.drv...
cannot build derivation `/gnu/store/z2ny4vkwyj6zkzk49xmv9vv7ycvgjqa0-curl-8.5.0.tar.xz.drv': 1 dependencies couldn't be built
cannot build derivation `/gnu/store/3q7mxdpdxm6bvyq5w1sh362q7697gd2s-curl-8.5.0.drv': 1 dependencies couldn't be built
guix build: error: build of `/gnu/store/3q7mxdpdxm6bvyq5w1sh362q7697gd2s-curl-8.5.0.drv' failed

--8<---------------cut here---------------end--------------->8---

again with a rust package:

--8<---------------cut here---------------start------------->8---

~ ❯ guix build rust-tls-parser@0.11.0 --no-substitutes

The following derivations will be built:

/gnu/store/vcniy96dp1dv4xz5fbrnwz73cmjl41iy-rust-tls-parser-0.11.0.drv

/gnu/store/5drm199dkajq59wwgrgb6yvir18xmnai-rust-cookie-factory-0.3.2.tar.gz.drv

/gnu/store/5dz7r9ilrfsk9g4381cfipgm1ahzrngn-rust-tls-parser-0.11.0.tar.xz.drv

/gnu/store/a5zsbv95j6kzaqb3x7qf77r5n8mn59z1-rust-tls-parser-0.11.0.tar.gz.drv

/gnu/store/fd877l3wwbgn5308dyd6facml52ah705-rust-phf-codegen-0.10.0.tar.gz.drv

/gnu/store/ib2ghrpb0yfsyym8acz7q0ng8rqbpmwx-rust-nom-derive-0.10.1.tar.gz.drv

/gnu/store/id8dimaglpv4r85gg4v7ilfbrc66sk5n-rust-output-vt100-0.1.2.tar.gz.drv

/gnu/store/inpl7s1nqr8pb83lhpsikhccw276dxf4-rust-rusticata-macros-4.0.0.tar.gz.drv

/gnu/store/jqqkmlm528wr3kq2pzp3q07qsg5gqcja-rust-pretty-assertions-0.7.2.tar.gz.drv

/gnu/store/mv16y11kfrv6v4n7swzkd8asqb8wlad0-rust-enum-primitive-0.1.1.tar.gz.drv

/gnu/store/w39y86bixvh7zpqz7q3shc13l879ifb2-rust-hex-literal-0.3.4.tar.gz.drv

/gnu/store/x66z1sjl67w21792wshjm52vv0mb4zp4-rust-nom-derive-impl-0.10.1.tar.gz.drv

building /gnu/store/5drm199dkajq59wwgrgb6yvir18xmnai-rust-cookie-factory-0.3.2.tar.gz.drv...

Starting download of /gnu/store/4xp3avl7391w19pvxk7hhklx3byanx10-rust-cookie-factory-0.3.2.tar.gz

From https://crates.io/api/v1/crates/cookie-factory/0.3.2/download...

following redirection to `https://static.crates.io/crates/cookie-factory/cookie-factory-0.3.2.crate'...

downloading from https://crates.io/api/v1/crates/cookie-factory/0.3.2/download ...

download 14KiB 9.6MiB/s 00:00 ▕██████████████████▏ 100.0%

suspicious ownership or permission on `/gnu/store/4xp3avl7391w19pvxk7hhklx3byanx10-rust-cookie-factory-0.3.2.tar.gz'; rejecting this build output

build of /gnu/store/5drm199dkajq59wwgrgb6yvir18xmnai-rust-cookie-factory-0.3.2.tar.gz.drv failed

View build log at '/var/log/guix/drvs/5d/rm199dkajq59wwgrgb6yvir18xmnai-rust-cookie-factory-0.3.2.tar.gz.drv.gz'.

cannot build derivation `/gnu/store/vcniy96dp1dv4xz5fbrnwz73cmjl41iy-rust-tls-parser-0.11.0.drv': 1 dependencies couldn't be built

guix build: error: build of `/gnu/store/vcniy96dp1dv4xz5fbrnwz73cmjl41iy-rust-tls-parser-0.11.0.drv' failed

--8<---------------cut here---------------end--------------->8---

guix version:

--8<---------------cut here---------------start------------->8---

guix df6ea8e

repository URL: https://git.savannah.gnu.org/git/guix.git

branch: master

commit: df6ea8e9e9a089f46abb841782ca623691efca4c

--8<---------------cut here---------------end--------------->8---

From:	Jonathan Nogueira
Subject:	bug#69868: Source downloads result in suspicious ownership or permission errors
Date:	Mon, 18 Mar 2024 06:12:52 +0000