sequoia-sq: 1.1.0 -> 1.2.0

[dvn0]

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[dvn0]

A test failed on my machine:

failures:

---- cli::download::sq_download stdout ----
Testing example from src/cli/download.rs:30
Executing: ["sq", "cert", "import", "debian/debian-cd-signing-key.pgp"]
Executing: ["sq", "download", "--url=file://debian/SHA512SUMS", "--signature-url=file://debian/SHA512SUMS.sign", "--signer=DF9B9C49EAA9298432589D76DA87E80D6294BE9B", "--output=SHA512SUMS"]
example:src/cli/download.rs:30: executing example #2: Unexpected failure.
code=1
stderr=`\`\`\`\`\`

  Error: builder error
because: OpenSSL error
\`\`\`
\`\`\`
command=`cd "/build/.tmpfZF2LZ" && SEQUOIA_CERT_STORE="/build/.tmpfZF2LZ/cert-store" SEQUOIA_CRYPTO_POLICY="/build/.tmpfZF2LZ/empty-policy.toml" SEQUOIA_HOME="/build/.tmpfZF2LZ/home" SEQUOIA_KEY_STORE="/build/.tmpfZF2LZ/key-store" "/build/source/target/x86_64-unknown-linux-gnu/release/sq" "--batch" "download" "--url=file://debian/SHA512SUMS" "--signature-url=file://debian/SHA512SUMS.sign" "--signer=DF9B9C49EAA9298432589D76DA87E80D6294BE9B" "--output=SHA512SUMS"`
code=1
stdout=""
stderr=\`\`\`

  Error: builder error
because: OpenSSL error
\`\`\`


thread 'cli::download::sq_download' panicked at src/cli/download.rs:30:1:
executing example failed
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    cli::download::sq_download

test result: FAILED. 99 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.39s

[doronbehar]

A test failed on my machine:

Since we disallow downloading content from the internet during build, it seems we'd have to disable this particular test, just like we disable already a test that with this update, shouldn't be disabled :) (See comment there linking to upstream issue).

[dvn0]

Since we disallow downloading content from the internet during build

I thought that's what it was, but it's not downloading from the internet, and I confirmed with the other sequoia devs.

See: "--url=file://debian/SHA512SUMS",

[doronbehar]

Or, on a 2nd look, perhaps it'd be possible to make that test use prefetched local files debian/SHA512SUMS & debian/SHA512SUMS.sign.

[doronbehar]

Yes you are right:) I wrote my 2nd comment while you wrote yours.

[dvn0]

I also spoke with the Fedora package maintainer, and they apparently run their builds in containers without network access, and sequoia-sq is passing all tests there. :/

[dvn0]

For reference the files are located in the repository tree here: https://gitlab.com/sequoia-pgp/sequoia-sq/-/tree/v1.2.0/tests/data/examples/debian

[doronbehar]

Maybe you could open an upstream issue? They are very nice from my experience. In either case, please remove that skipped test in the checkFlags - as that issue was resolved in this release.

[dvn0]

Maybe you could open an upstream issue? They are very nice from my experience.

I work on the project, so thank you for the compliment!

Will definitely be opening a ticket. I wanted to see it fail in CI here, but looks like ofborg is unhappy about the vendor hash for some reason... Going to try to update that first.

[dvn0]

Upstream issue: https://gitlab.com/sequoia-pgp/sequoia-sq/-/issues/545