nixos default channel: use http instead of https #2688

vcunat · 2014-05-18T18:52:12Z

AFAIK https doesn't work in nixos-rebuild --upgrade. I just stumbled into it on a clean install, and I think that I heard before users complaining about errors like this.

Any comments?

AFAIK https doesn't work in nixos-rebuild --updgrade. I just stumbled into it on a clean install, and I think that I heard before users complaining about errors like this.

lucabrunox · 2014-05-18T19:09:19Z

Never had a problem installing nixos with https cache as default cache.

On Sun, May 18, 2014 at 8:52 PM, Vladimír Čunát [email protected]:

AFAIK https doesn't work in nixos-rebuild --updgrade. I just stumbled into
it on a clean install, and I think that I heard before users complaining
about errors like this.

Any comments?

You can merge this Pull Request by running

git pull https://github.com/vcunat/nixpkgs p/channel

Or view, comment on, or merge it at:

#2688
Commit Summary

nixos default channel: use http instead of https

File Changes

M nixos/modules/misc/version.nixhttps://github.com/nixos default channel: use http instead of https #2688/files#diff-0(2)

Patch Links:

https://github.com/NixOS/nixpkgs/pull/2688.patch

https://github.com/NixOS/nixpkgs/pull/2688.diff

—
Reply to this email directly or view it on GitHubhttps://github.com//pull/2688
.

www.debian.org - The Universal Operating System

vcunat · 2014-05-18T19:50:47Z

Today I was installing on a clean HW:

$ sudo nixos-rebuild build --upgrade
/run/current-system/sw/bin/nix-channel: unable to check `https://nixos.org/channels/nixos-14.04'

After changing https to http it worked without a problem.

shlevy · 2014-05-18T20:03:35Z

Yeah, I have to use sudo -i. Never realized it was an https issue

vcunat · 2014-05-18T21:04:30Z

:-D

kirelagin · 2014-05-19T08:19:21Z

Wouldn't it be way better to fix the real issue?

vcunat · 2014-05-19T09:15:04Z

I'm not sure what's the issue, but the https URIs in there are just 302 redirects to http URIs (of a particular channel version). Consequently, it IMO provides practically no security.

kirelagin · 2014-05-19T09:20:32Z

The issue is that curl needs a CA bundle to verify the server certificate and it takes it from env CURL_CA_BUNDLE which is unset when doing sudo. Running curl without --silent (as nix-channel does) is enough to see the error ;).

kirelagin · 2014-05-19T09:25:18Z

Adding

Defaults:root,%wheel env_keep+=CURL_CA_BUNDLE

to sudoers might suffice as a temporary solution, although its security is very questionable.

cstrahan · 2014-06-02T01:49:56Z

@kirelagin

Would using environment.systemVariables from your #2692 be a valid solution?

kirelagin · 2014-06-02T06:35:08Z

@cstrahan Given that #2692 was made specifically to fix this issue, the answer is yes =).

cstrahan · 2014-06-02T12:46:17Z

@kirelagin Ha! Late night hacking - totally missed the fact that you referenced this PR. Cool. 😊

vcunat · 2014-06-10T09:51:48Z

Using https is IMO still pointless (as it's just a redirect to http path), but at least it shouldn't cause problems after #2692.

CMCDragonkai · 2014-07-21T02:54:58Z

Why is the HTTPS URL redirecting to an HTTP url? If there's a proper cert for HTTPS, why not keep all the downloads available over HTTPS? Also shouldn't all downloads be over HTTPS anyway?

vcunat · 2014-07-21T09:08:06Z

IIRC, it was claimed that https isn't possible on the Amazon cloud hosting (at least not with our certificates). I don't have a clue what's the consensus about these things, considering reactions to this issue and contents of the manual.

Manual suggests using http, then shows an example with https, and system.defaultChannel has https default... CC @edolstra

kirelagin · 2014-07-21T09:31:47Z

I think the consensus is that all the data is signed anyway, so https doesn't add anything in terms of security. But the https url is recommended just in case something changes in the future.

vcunat · 2014-07-21T09:39:57Z

I don't think we're using the signing yet NixOS/nix#75

kirelagin · 2014-07-21T09:44:06Z

But all the files are hashed, right? So it's enough to sign manifests. But it seems they are neither signed NixOS/nix#18… =(

vcunat · 2014-07-21T09:52:42Z

Manifests aren't used nowadays, as commented on the issue. IIRC, there is support for signed binary caches, but not used by our Hydra.nixos.org (yet).

CMCDragonkai · 2014-07-21T12:25:58Z

I think this should be a priority to be fixed. Could result in security issues. Either we use full https, or everything must be signed.

edolstra · 2014-07-21T18:26:57Z

The redirect to http is kind of an unintended side effect. The reason for the redirect was to serve ISOs via CloudFront. But we don't really need that for the channel nixexprs.tar.bz2. I can probably make the redirect only do the ISOs.

edolstra · 2014-08-05T10:54:39Z

The redirect to http is now gone, so the channel's nixexprs.tar.xz is served over https.

vcunat · 2014-08-08T18:17:42Z

So we should unify defaults in source and manual to https, or not?

ballo · 2015-11-12T06:13:00Z

I just attempted a fresh install on OS X and got this error. Why is this ticket closed?

vcunat · 2015-11-12T07:15:44Z

This PR is against release 14.04 which is long unsupported.
You probably need to provide more specific info to get to the root of the issue.

ballo · 2015-11-12T08:01:02Z

OK, specifically I ran (as instructed):

curl https://nixos.org/nix/install | sh

aaaaand, that's it.

kirelagin · 2015-11-12T08:19:37Z

@ballo OK, given the information you provided, looks like something is not working.

Actually I also got this error when trying to do nix-channel --update last week. I just tried a couple more times and it started to work. I couldn’t figure out what was wrong, but I don‘t think this was related to this issue.

vcunat · 2015-11-12T08:50:11Z

I believe the script runs curl -L https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-darwin.tar.bz2 (on darwin), and that works for me ATM (on linux).

ballo · 2015-11-12T08:54:02Z

This is Yosemite, BTW

cstrahan · 2015-11-15T03:13:57Z

I just installed Nix on my new Mac and I'm also still getting this. This is on El Capitan.

ballo · 2015-11-15T03:15:21Z

Oh good, it isn't just Yosemite. Hopefully this can be fixed for both

Treeant34 · 2015-12-07T01:38:40Z

Tried installing Nix twice on OS X 10.10.5 (VMWare Fusion 8 guest) using the shell command (curl https://nixos.org/nix/install | sh) and keep getting the same error (unable to check ‘https://nixos.org/channels/nixpkgs-unstable’).

NixOS/nix#728

I wanted to try this package manager on OS X, as I really see this as the package management model for the future, but I am stumped at the moment (being a Nix Newb). There isn't a pile of info out there for OS X installation regarding Nix. Is it possible to execute multiple commands in terminal to get Nix installed on Yosemite (since the script install doesn't want to work) and if so, what are they?

Help?

Thx

chrislambda · 2015-12-08T15:41:13Z

Same problem here, running OS X Yosemite 10.10.5. I just ran the command:

curl https://nixos.org/nix/install | sh

and got

/nix/store//nix-1.10/bin/nix-channel: unable to check ‘https://nixos.org/channels/nixpkgs-unstable’

ivan-krukov · 2016-01-16T02:08:10Z

Seeing the same issue on a fresh El Capitan installation.
After seeing the error the first time, I have changed the $url on line 30 to http, and the installation completed (apparently) successfully.

curl https://nixos.org/nix/install -O
sed -i '' 's/http/https/g' install
sh ./install

nixos default channel: use http instead of https

1186d4c

AFAIK https doesn't work in nixos-rebuild --updgrade. I just stumbled into it on a clean install, and I think that I heard before users complaining about errors like this.

kirelagin mentioned this pull request May 19, 2014

Use pam_env to properly setup system-wide env #2692

Closed

vcunat closed this Jun 10, 2014

vcunat deleted the p/channel branch June 15, 2014 17:11

pSub mentioned this pull request Aug 6, 2014

Fix 'Getting Nixpkgs' documentation #3480

Closed

vcunat restored the p/channel branch October 18, 2014 16:54

vcunat deleted the p/channel branch November 12, 2015 07:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nixos default channel: use http instead of https #2688

nixos default channel: use http instead of https #2688

vcunat commented May 18, 2014

lucabrunox commented May 18, 2014

Any comments?

vcunat commented May 18, 2014

shlevy commented May 18, 2014

vcunat commented May 18, 2014

kirelagin commented May 19, 2014

vcunat commented May 19, 2014

kirelagin commented May 19, 2014

kirelagin commented May 19, 2014

cstrahan commented Jun 2, 2014

kirelagin commented Jun 2, 2014

cstrahan commented Jun 2, 2014

vcunat commented Jun 10, 2014

CMCDragonkai commented Jul 21, 2014

vcunat commented Jul 21, 2014

kirelagin commented Jul 21, 2014

vcunat commented Jul 21, 2014

kirelagin commented Jul 21, 2014

vcunat commented Jul 21, 2014

CMCDragonkai commented Jul 21, 2014

edolstra commented Jul 21, 2014

edolstra commented Aug 5, 2014

vcunat commented Aug 8, 2014

ballo commented Nov 12, 2015

vcunat commented Nov 12, 2015

ballo commented Nov 12, 2015

kirelagin commented Nov 12, 2015

vcunat commented Nov 12, 2015

ballo commented Nov 12, 2015

cstrahan commented Nov 15, 2015

ballo commented Nov 15, 2015

Treeant34 commented Dec 7, 2015

chrislambda commented Dec 8, 2015

ivan-krukov commented Jan 16, 2016

nixos default channel: use http instead of https #2688

nixos default channel: use http instead of https #2688

Conversation

vcunat commented May 18, 2014

lucabrunox commented May 18, 2014

Any comments?

vcunat commented May 18, 2014

shlevy commented May 18, 2014

vcunat commented May 18, 2014

kirelagin commented May 19, 2014

vcunat commented May 19, 2014

kirelagin commented May 19, 2014

kirelagin commented May 19, 2014

cstrahan commented Jun 2, 2014

kirelagin commented Jun 2, 2014

cstrahan commented Jun 2, 2014

vcunat commented Jun 10, 2014

CMCDragonkai commented Jul 21, 2014

vcunat commented Jul 21, 2014

kirelagin commented Jul 21, 2014

vcunat commented Jul 21, 2014

kirelagin commented Jul 21, 2014

vcunat commented Jul 21, 2014

CMCDragonkai commented Jul 21, 2014

edolstra commented Jul 21, 2014

edolstra commented Aug 5, 2014

vcunat commented Aug 8, 2014

ballo commented Nov 12, 2015

vcunat commented Nov 12, 2015

ballo commented Nov 12, 2015

kirelagin commented Nov 12, 2015

vcunat commented Nov 12, 2015

ballo commented Nov 12, 2015

cstrahan commented Nov 15, 2015

ballo commented Nov 15, 2015

Treeant34 commented Dec 7, 2015

chrislambda commented Dec 8, 2015

ivan-krukov commented Jan 16, 2016