bug#35561: Fresh install, guix pull exits with error, hash mismatch

[Ludovic Courtès]

Hi,

Calle Kabo <address@hidden> skribis:

> address@hidden ~$ guix pull

[...]

> building 
> /gnu/store/vf1ni4bdwlya3f5ii7wq6agiwdvzapmw-letsencryptauthorityx3.pem.drv...
> downloading from https://letsencrypt.org/certs/letsencryptauthorityx3.pem...
> |sha256 hash mismatch for 
> /gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem:
>   expected hash: 0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk
>   actual hash:   1kvac1dhm1d02bhrfj6l1cz1dpldz6ishb78zzvy8245zgvh7pdn
> hash mismatch for store item 
> '/gnu/store/bcq7sqhg18b7b1q87j8z60d5hybsdafm-letsencryptauthorityx3.pem'

These 3 files are now available from https://ci.guix.gnu.org as
substitutes:

--8<---------------cut here---------------start------------->8---
$ sha1sum *.pem
af259e2e2ebd686861e3f89be6845298bed6c223  isrgrootx1.pem
36205ada14d1cded7e85294762630b6b57088198  letsencryptauthorityx3.pem
59057c31e97d8e10cc52edb389b1e87089a245aa  letsencryptauthorityx4.pem
$ for i in *.pem; do echo $(guix hash $i) $i ; done
0zhd1ps7sz4w1x52xk3v7ng6d0rcyi7y7rcrplwkmilnq5hzjv1y isrgrootx1.pem
0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk letsencryptauthorityx3.pem
003dc94c8qwj634h0dq743x7hqv9rdcfaisdksprkmi2jd107xq4 letsencryptauthorityx4.pem
--8<---------------cut here---------------end--------------->8---

and the ‘le-certs’ package itself is now available as a substitute from
ci.guix.gnu.org.

For the record, this failure stems from the combination of two issues:
(1) letsencrypt.org modified these PEM files in place, and (2) the old
copies had disappeared from ci.guix.gnu.org.  Fortunately they were still
on mirror.hydra.gnu.org, which is where I copied them frmo.

We should also update our ‘le-certs’ package definition to refer to the
new file hashes.

Ludo’.