GNU bug report logs - #42971
When following instructions in the "Building from Git" manual node, 'git verify-commit...' fails. File got moved?

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 42971 in the body.
You can then email your comments to 42971 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: tchrzcz <at> protonmail.com
To: "bug-guix <at> gnu.org" <bug-guix <at> gnu.org>
Subject: When following instructions in the "Building from Git" manual node,
 'git verify-commit...' fails. File got moved?
Date: Fri, 21 Aug 2020 15:43:54 +0000

Hello,

https://guix.gnu.org/manual/en/html_node/Building-from-Git.html#Building-from-Git says:

"How do you ensure that you obtained a genuine copy of the repository? Guix itself provides a tool to authenticate your checkout, but you must first make sure this tool is genuine in order to “bootstrap” the trust chain. To do that, run:

git verify-commit `git log --format=%H build-aux/git-authenticate.scm`"

1. When I run the command, I get the following error:

"fatal: ambiguous argument 'build-aux/git-authenticate.scm': unknown revision or path not in the working tree.
Use '--' to separate paths from revisions, like this:
'git <command> [<revision>...] -- [<file>...]'
usage: git verify-commit [-v | --verbose] <commit>...

    -v, --verbose         print commit contents
    --raw                 print raw gpg status output"


2. So I looked for "git-authenticate.scm" with 'find' and got two results:
./tests/git-authenticate.scm
./guix/git-authenticate.scm

3. These two are different files, sizes don't match, 'diff' outputs a lot of stuff.

4. I searched for "git-authenticate" in NEWS, HACKING and README and didn't find anything.

5. Then I figured I'd look in Git commits and found these two:

https://git.savannah.gnu.org/cgit/guix.git/commit/?id=41f443c90af57f9537eccb1a1a45c6e11b377a32 "Add (guix git-authenticate)."
https://git.savannah.gnu.org/cgit/guix.git/commit/?id=96bf434c70c4346c6402658d3ec57ef64a8e521e "maint: Remove 'build-aux/git-authenticate.scm'."

I'm not fluent in Git, GPG, nor Guile. Do I just run the command with "guix/git-authenticate.scm" instead of "build-aux/git-authenticate.scm"?

Regards,
tchrzcz

Message #8 received at 42971 <at> debbugs.gnu.org (full text, mbox):

From: Julien Lepiller <julien <at> lepiller.eu>
To: tchrzcz <at> protonmail.com,42971 <at> debbugs.gnu.org
Subject: Re: bug#42971: When following instructions in the "Building from Git"
 manual node, 'git verify-commit...' fails. File got moved?
Date: Fri, 21 Aug 2020 14:17:55 -0400

[Message part 1 (text/plain, inline)]

The mecanism has changed since last release, see https://guix.gnu.org/manual/devel/en/html_node/Building-from-Git.html#Building-from-Git

(Note "devel" in the URL, it corresponds to the latest master). We now use "guix git authenticate" to authenticate the repository.

On 2020年8月21日 11:43:54 GMT-04:00, tchrzcz--- via Bug reports for GNU Guix <bug-guix <at> gnu.org> wrote:
>Hello,
>
>https://guix.gnu.org/manual/en/html_node/Building-from-Git.html#Building-from-Git
>says:
>
>"How do you ensure that you obtained a genuine copy of the repository?
>Guix itself provides a tool to authenticate your checkout, but you must
>first make sure this tool is genuine in order to “bootstrap” the trust
>chain. To do that, run:
>
>git verify-commit `git log --format=%H build-aux/git-authenticate.scm`"
>
>1. When I run the command, I get the following error:
>
>"fatal: ambiguous argument 'build-aux/git-authenticate.scm': unknown
>revision or path not in the working tree.
>Use '--' to separate paths from revisions, like this:
>'git <command> [<revision>...] -- [<file>...]'
>usage: git verify-commit [-v | --verbose] <commit>...
>
>    -v, --verbose         print commit contents
>    --raw                 print raw gpg status output"
>
>
>2. So I looked for "git-authenticate.scm" with 'find' and got two
>results:
>./tests/git-authenticate.scm
>./guix/git-authenticate.scm
>
>3. These two are different files, sizes don't match, 'diff' outputs a
>lot of stuff.
>
>4. I searched for "git-authenticate" in NEWS, HACKING and README and
>didn't find anything.
>
>5. Then I figured I'd look in Git commits and found these two:
>
>https://git.savannah.gnu.org/cgit/guix.git/commit/?id=41f443c90af57f9537eccb1a1a45c6e11b377a32
>"Add (guix git-authenticate)."
>https://git.savannah.gnu.org/cgit/guix.git/commit/?id=96bf434c70c4346c6402658d3ec57ef64a8e521e
>"maint: Remove 'build-aux/git-authenticate.scm'."
>
>I'm not fluent in Git, GPG, nor Guile. Do I just run the command with
>"guix/git-authenticate.scm" instead of
>"build-aux/git-authenticate.scm"?
>
>Regards,
>tchrzcz

[Message part 2 (text/html, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.