Re: Authenticating maintenance.git

[Chris Marusich <cmmarusich@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2106 bytes --]

Chris Marusich <cmmarusich@gmail.com> writes:

> Hi Ludo,
>
> Ludovic Courtès <ludo@gnu.org> writes:
>
>> It looks like you’re missing a local ‘keyring’ branch for that repo, no?
>>
>> I think you need to run:
>>
>>   git fetch
>>   git branch --track keyring
>
> This works, basically.  Thank you!

Although I was now able to run the pre-push hook, it seems unaware of my
PGP key.  I tried making the attached change to the README and testing a
push via "git push -n origin", and it complained about the signature:

--8<---------------cut here---------------start------------->8---
$ git push -n origin
Authenticating commits 8a7e10b to 413b8f1 (1 new commits)...
[##############################################################################]guix git: error: could not authenticate commit 413b8f1c6d9ca2160d7aa8d80db181a6f39d3d82: key CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D is missing
error: failed to push some refs to 'git.savannah.gnu.org:/srv/git/guix/maintenance.git'
--8<---------------cut here---------------end--------------->8---

However, the signature looks good to me:

--8<---------------cut here---------------start------------->8---
$ git verify-commit 413b8f1c6d9ca2160d7aa8d80db181a6f39d3d82
gpg: Signature made Tue 22 Jun 2021 05:54:13 PM PDT
gpg:                using RSA key CBF59755CBE7E7EFEF183FB1DD409A15D822469D
gpg: Good signature from "Chris Marusich <cmmarusich@gmail.com>" [ultimate]
--8<---------------cut here---------------end--------------->8---

GnuPG reports it can find the keys:

--8<---------------cut here---------------start------------->8---
$ gpg --list-keys 'CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D'
pub   rsa4096 2016-02-19 [SC] [expires: 2021-08-13]
      CBF59755CBE7E7EFEF183FB1DD409A15D822469D
uid           [ultimate] Chris Marusich <cmmarusich@gmail.com>
sub   rsa4096 2016-02-19 [E] [expires: 2021-08-13]
--8<---------------cut here---------------end--------------->8---

This happens even if I update guix with "guix pull".  Any idea what the
problem might be?

-- 
Chris

[-- Attachment #1.2: 0001-README-Clarify-that-pre-push-hook-needs-keyring.patch --]
[-- Type: text/x-patch, Size: 1418 bytes --]

From 413b8f1c6d9ca2160d7aa8d80db181a6f39d3d82 Mon Sep 17 00:00:00 2001
From: Chris Marusich <cmmarusich@gmail.com>
Date: Tue, 22 Jun 2021 17:51:07 -0700
Subject: [PATCH] README: Clarify that pre-push hook needs keyring.

* README: Explain that the pre-push hook requires the existence of a
local keyring branch, and add a "git branch" command to show how to
create one.
---
 README | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/README b/README
index 338895b..71dc641 100644
--- a/README
+++ b/README
@@ -1,8 +1,10 @@
 This repository is meant to contain documents and tools by Guix hackers
 and maintainers that do not fit in the Guix repository.
 
-If you’re a committer, please install this pre-push hook:
+If you’re a committer, please create a local keyring branch that
+tracks origin/keyring and install this pre-push hook:
 
+git branch --track keyring origin/keyring
 cat > .git/hooks/pre-push <<EOF
 #!/bin/sh
 exec guix git authenticate 8a7e10b447b574279a7016ae6ea15bc7bcd46253 "3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5"
@@ -10,4 +12,5 @@ EOF
 chmod +x .git/hooks/pre-push
 
 This will check whether your commits are signed by a key listed in
-‘.guix-authorizations’ before pushing.
+‘.guix-authorizations’ before pushing.  It requires a local keyring
+branch to exist, hence the "git branch" command above.
-- 
2.30.2


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]