Subject: bug#78283: guix git authenticate is indiscriminant in which branches it applies to

From: Vagrant Cascadian <[email-masked]>
Date: Tue, 06 May 2025 11:31:53 -0700

So, when I update my local keyring branch with new merges, guix git
authenticate issues a non-fatal error:

  $ git checkout keyring
  Switched to branch 'keyring'
  $ git reset --hard 21173006e4165d8990b75ca46c78d83448d2e45a
  HEAD is now at 21173006e4 Add key for Greg Hogan.
  $ git merge --ff-only origin/keyring
  Updating 21173006e4..0869e2220d
  Fast-forward
   futurile-89CA9B07.key | 23 +++++++++++++++++++++++
   1 file changed, 23 insertions(+)
   create mode 100644 futurile-89CA9B07.key
  Authenticating commits 5010a51 to 0869e22 (31 new commits)...
  guix git: error: commit 0869e2220d611d7202de64dba4fa81207522a4f9 is not a descendant of introductory commit 5010a51f91aeac5a3b87a3eea04f18f3fe8a3a3

Which is a bit alarming!

.git/config contains:

  [guix "authentication"]
        introduction-commit = 5010a51fc91aeac5a3b87a3eea04f18f3fe8a3a3
        introduction-signer = 1A858392E331EAFDB8C27FFBF3C1A0D9C1D65273
        keyring = keyring

Looks like something also created .git/hooks/post-merge:

  #!/bin/sh
  # Authenticate the repo upon 'git pull' and similar.
  exec guix git authenticate

On the one hand, I get why it magically appeared probably when I
initially ran "guix git authenticate", but on the other, it is
surprising behavior as I do not recall asking for it. :)

live well,
  vagrant