GNU bug report logs - #57909
Add link to 'pre-inst-env' from 'installing from git' docs

Previous Next

Full log

View this message in rfc822 format

From: Ludovic Courtès <ludo <at> gnu.org>
To: Maxime Devos <maximedevos <at> telenet.be>
Cc: 57910 <at> debbugs.gnu.org, 57909 <at> debbugs.gnu.org, Emma Turner <em.turner <at> tutanota.com>
Subject: [bug#57909] bug#57910: [PATCH] Add link to 'pre-inst-env' from 'installing from git' docs
Date: Sun, 25 Sep 2022 22:05:59 +0200

Hi,

Maxime Devos <maximedevos <at> telenet.be> skribis:

> While ordinarily, it is true that "make authenticate" runs "guix git
> authenticate" (and not ./pre-inst-env guix git authenticate), an
> attacker could have modified Makefile.am to _not_ call "guix git
> authenticate", as I've explained in the paragraph above the one you
> quoted:

Oh you’re right; sorry for overlooking this.

So yes, that calls for recommending the full ‘guix git authenticate’
command for the initial checkout.

Thanks,
Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.