Nixpkgs: GnuTLS fails to build for non-default nix store: Several packages fails to build because of mismatched sha256 hash

[rowhit]

Issue description

I am trying to build multiple packages form nix channels nixpkgs-unstable and nixos-17.09 to a non-default nix store. Some of the packages fails to build complaining sha256sum hash mismatch. However, when I see the binary available for the same packages in the nix channels. As long as the nix is built with a different storeDir and stateDir, it should be fine. Many common packages are building fine except few. I am wondering if there is a way to override these default if not specified as override option in the package definition itself. I have heard about overlay but haven't been able to get it working.

Steps to reproduce

nix-env -iA nixpkgs.slurm -j32
with storeDir=$HOME/opt/nix/store
with stateDir=$HOME/opt/nix/state

Technical details

Please run nix-shell -p nix-info --run "nix-info -m" and paste the
results.

• system: "x86_64-linux"
• host os: Linux 2.6.32-696.16.1.el6.x86_64

[orivej]

Some of the sources necessary to build the packages are no longer available or have changed, which results in hash mismatch errors. (The master branch must be better in this respect than the release-17.09 branch.) This does not affect /nix/store because the sources for /nix/store are cached on Hydra and at cache.nixos.org. Occasionally we discover such issues and fix them.

Many common packages are building fine except few. I am wondering if there is a way to override these default if not specified as override option in the package definition itself. I have heard about overlay but haven't been able to get it working.

Just clone this repo, build from it, and edit what is necessary to fix the build. Then please submit your fixes for the benefit of the others.

You may have better experience with Nix in chroot. I have not used it, but nix-user-chroot may work.

[orivej]

Since you are on Linux 2.6.32, the master branch is not going to work for you because it contains glibc 2.26 which requires Linux 3.2. You will have to stay with release-17.09 (and may find some fixes for the hash mismatch or dead source errors in master branch).

[orivej]

See this about nix-user-chroot: https://nixos.wiki/wiki/Nix_Installation_Guide#Installing_without_root_permissions

[FRidh]

@orivej @vcunat Hydra supports repeated builds for checking reproducibility. We could create a job that does repeated builds of drv.src.

[vcunat]

I can't see where to check that on Hydra, but repeated builds won't help by itself – we need to preferHashedMirrors = false as well.

[rowhit]

I have done as suggested by orivej, copied the repo and changed the hash as required. However, this probably goes against the principle of immutable build system. The current caches does not get rebuilt even when the hash is changed is weird.

[orivej]

OK. Could you publish your fixes on GitHub, or list the packages whose hashes you had to change?

[rowhit]

I had to change hash for pkgs/data/misc/dns-root-data/default.nix for branch 17.09
# old hash
#sha256 = "01n4bqf95kbvig1hahqzmmdkpn4v7mzfc1p944gq922i5j3fjr92";
# new hash
sha256 = "05nlfqvny1hy2kwaf03qb7bwcpxncfp6ds0b14symqgl9csziz1i";

[rowhit]

The build continues but is stuck at PASS: dtls-rehandshake-cert-2. It has been in this state for past 9 hours.

[orivej]

I have not encountered such issue (see our CI). Could you terminate and restart the build? Only gnutls will be rebuilt.

[rowhit]

I have tried to stop and rebuild multiple times, however, still it get stuck everytime at the same place PASS: dtls-rehandshake-cert-2. Does it need some randomness enabled for entropy?

[orivej]

You may compare the list of tests in the CI (ending with PASS: dtls-rehandshake-cert-2 ) with your list of tests to find out which is hanging. (Note that they are ordered differently in different runs.) To progress further without debugging the cause of the hang, you may disable gnutls tests by replacing inherit doCheck; with doCheck = false; in pkgs/development/libraries/gnutls/generic.nix.

[rowhit]

The above did solve my issue and I am able to install packages. However, I am finding few more packages that are broken.

• "fribidi"
  
  
  
  • src is not reachable.
  
  
  • Additionally I see the following error after fixing the default.nix for the above package:
    
    ./configure: line 13469: syntax error near unexpected token GLIB,$GLIB_PACKAGE' ./configure: line 13469:PKG_CHECK_MODULES(GLIB,$GLIB_PACKAGE >=$GLIB_MINVERSION)'
    
    I do not know how to fix this. Possibly directly editing the configure script but when I look at the configure file there is no line 13469.