bug#70243: The substitute authorization warning is displayed when it shouldn't be

[Simon Tournier]

Hi,

On Sat, 25 May 2024 at 11:31, Ludovic Courtès <ludo@gnu.org> wrote:

>> But, I do have the given key in my '/etc/guix/acl', and this works:
>
> Are /etc/guix/acl and /etc/guix world-readable?

I had been bitten by this recently.  And I have not found any mention
about that in the manual.  Maybe it could helpful to add:

diff --git a/doc/guix.texi b/doc/guix.texi
index 5e1173b8c6..3b97674733 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -3792,7 +3792,8 @@ Getting Substitutes from Other Servers
 @end example
 
 Again this assumes @file{key.pub} contains the public key that
-@code{guix.example.org} uses to sign substitutes.
+@code{guix.example.org} uses to sign substitutes.  Make sure
+@file{/etc/guix/acl} is world-readable.
 @end enumerate
 
 Now you're all set!  Substitutes will be preferably taken from


In addition, I had to be read a comment in source code to know what
another issue was: the daemon’s too old.  Hence, I would suggest:

diff --git a/guix/scripts/weather.scm b/guix/scripts/weather.scm
index 08a1b22a74..98a09f9e9a 100644
--- a/guix/scripts/weather.scm
+++ b/guix/scripts/weather.scm
@@ -643,7 +643,7 @@ (define-command (guix-weather . args)
                              ;; substitute URLs, presumably because it's too
                              ;; old.
                              (warning (G_ "using default \
-substitute URLs~%"))
+substitute URLs; maybe the daemon's too old~%"))
                              %default-substitute-urls)))
              (systems  (match (filter-map (match-lambda
                                             (('system . system) system)

Both would ease the debugging session of substitute authorization, IMHO.

Cheers,
simon