Hi Leo, Leo Famulari writes: > On Sat, May 01, 2021 at 01:45:57AM -0400, Maxim Cournoyer wrote: >> https://alpha.gnu.org/gnu/guix/guix-binary-1.3.0rc1.x86_64-linux.tar.xz > > I tested the binary tarball on x86_64. > > I used `guix package --export-manifest > manifest` before beginning the > test, so that I could easily recreate my profile afterwards. > >> All these files have an associated ‘.sig’, an OpenPGP signature that you >> can verify as explained at >> . > > These instructions explain how to get Ludo's key, but that wasn't used > here. > > In doc/guix.texi, the variables OPENPGP-SIGNING-KEY-ID and > OPENPGP-SIGNING-KEY-URL are defined. > > Maybe we should update the manual to mention "1.3.0rc1" and the correct > key. > > The "normal" manual would still mention 1.2.0, but the devel manual > would work for 1.3.0rc1. I think that it's fine to mention the release > candidate in the "devel" manual. > > https://guix.gnu.org/manual/en/ > https://guix.gnu.org/manual/devel/en/ Thank you for pointing that issue; I caught the problem with guix-install.sh before posting, but overlooked that one. As you pointed, that won't be reflected on our website, but I agree that having the new key covered in the devel manual (master branch) is already an improvement. The attached patch augments the manual to cover for the new key. Let me know if it looks good to you. If it does, I will push it to the master branch (IIUC we can't push this change to the version-1.3.0 branch as that would break the string freeze there). >> >> 1. Testing the binary tarball on the distro of your choice. You can >> download . Uncomment the >> ‘GNU_URL’ variable assignment that refers to alpha.gnu.org and it >> should pick up 1.3.0rc1 automatically. > > The install.sh script also recommends installing Ludo's key, but of > course fails to verify the signature with it. After installing Ludo's > key, the installer does suggest the correct key — Maxim's. Are you sure you downloaded it from https://guix.gnu.org/install.sh (which just redirects to the current copy on the master branch) ? Since commit e64af2060e8cfa48e74b887281acb3fd4c7e7781 (which was made just before writing the original message), it checks for both keys. > Aside from that, the install.sh script worked fine on current Debian, > and I was able to conveniently restore my Guix profile with `guix > package -m ./manifest`. > > Then I did `guix pull && guix upgrade`. All good! > > I forgot to remove the existing Guix build users and the guixbuild group > before my test. It would be great if somebody can remember to check that > they are created successfully by the script. I've tested the install script in a Ubuntu 20.04 VM which had never known Guix, and it was successful. I guess that part is covered :-). Thanks for the tests and feedback! Maxim