Hi David and Mark, Thank you both for taking a look at this! "Thompson, David" writes: > When I encountered a similar situation at work I opted to use https > cloning with a password token in the url. Then there was no external > state (like an rsa key) needed. This is good to know! I hadn't considered putting the secret into the URL. I can see how that might be a simple and appropriate solution in some situations. However, it would also be nice if Guix could fetch Git repositories over SSH using public key authentication. In some situations, SSH public key authentication may be the only option. Mark H Weaver writes: > My hacky approach has been to manually add a tarball of the desired > sources using "guix download file:///home/mhw/foo.tar.gz" and then to > add a bogus origin but with the correct hash. If a file with a matching > hash is already in the store, then it will be used, and the other fields > of the 'origin' will effectively be ignored. That's a neat trick! It looks like it would work well for ad-hoc hacking. But how does it scale? Imagine if you wanted to do this for 10 packages, or 100. The manual upkeep could become quite painful. It would be so much nicer if Guix could just download the source automatically, as usual! You've both said that you would prefer not to add git-fetch/impure to Guix. Can you help me to understand why you feel that way? I really think it would be nice if Guix could fetch Git repositories over SSH using public key authentication, so I'm hoping that we can talk about it and figure out an acceptable way to implement it. -- Chris