GNU bug report logs - #41767
[PATCH 0/9] Authenticate channels

Previous Next

Full log

Message #70 received at 41767-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: 41767-done <at> debbugs.gnu.org
Cc: 22883 <at> debbugs.gnu.org
Subject: Re: [bug#41767] [PATCH 0/9] Authenticate channels
Date: Tue, 16 Jun 2020 16:22:54 +0200

Hi,

Ludovic Courtès <ludo <at> gnu.org> skribis:

>   git-authenticate: Cache takes a key parameter.
>   git-authenticate: 'authenticate-commits' takes a #:keyring parameter.
>   tests: Move OpenPGP helpers to (guix tests gnupg).
>   channels: 'latest-channel-instance' authenticates Git checkouts.
>   channels: Make 'validate-pull' call right after clone/pull.
>   .guix-channel: Add 'keyring-reference'.
>   channels: Automatically add introduction for the official 'guix'
>     channel.
>   pull: Add '--disable-authentication'.
>   DROP? channels: Add prehistorical authorizations to
>     <channel-introduction>.

Pushed!

  619972f7b5 maint: "make authenticate" behaves like 'guix pull' by default.
  838ac881ec time-machine: Add '--disable-authentication'.
  a9eeeaa6ae pull: Add '--disable-authentication'.
  c3f6f564e9 channels: Automatically add introduction for the official 'guix' channel.
  a941e8fe1f .guix-channel: Add 'keyring-reference'.
  5bafc70d1e channels: Make 'validate-pull' call right after clone/pull.
  43badf261f channels: 'latest-channel-instance' authenticates Git checkouts.
  1e2b9bf2d4 tests: Move OpenPGP helpers to (guix tests gnupg).
  41946b79f1 git-authenticate: 'authenticate-commits' takes a #:keyring parameter.
  a450b4343b git-authenticate: Cache takes a key parameter.

I made the following changes:

  1. The introductory of the ‘guix’ channel is now
     9edb3f66fd807b096b48283debdcddccfea34bad (was
     87a40d7203a813921b3ef0805c2b46c0026d6c31).  This is because one of
     the parents of 9edb3f66fd807b096b48283debdcddccfea34bad lacks
     ‘.guix-authorizations’.  Consider it set in stone now!

  2. I added ‘--disable-authentication’ for ‘guix time-machine’ in a
     extra commit (it was easier than I thought because we don’t need to
     disable inferior caching).

  3. In an extra commit, I made “make authenticate” behave like ‘guix
     pull’ by default—i.e., assume that commits whose parent lack the
     ‘.guix-authorizations’ file are unauthorized.  It’s still possible
     to run “make authenticate GUIX_USE_HISTORICAL_AUTHORIZATIONS=yes”
     to assume “historical authorizations” for those commits.

Future work includes making that mechanism available to third-party
channels, which in turn means providing a public interface for “channel
introductions” and probably a ‘guix channel’ CLI, as discussed earlier.

Let me know if you notice anything wrong!

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.