From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp12.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms9.migadu.com with LMTPS id aIucH8orWGTdKAAASxT56A (envelope-from ) for ; Mon, 08 May 2023 00:52:58 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp12.migadu.com with LMTPS id cMF3H8orWGSy2gAAauVa8A (envelope-from ) for ; Mon, 08 May 2023 00:52:58 +0200 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 346A245942 for ; Mon, 8 May 2023 00:52:58 +0200 (CEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pvnEx-00065b-Rq; Sun, 07 May 2023 18:52:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pvnEx-00065S-A3 for guix-devel@gnu.org; Sun, 07 May 2023 18:52:27 -0400 Received: from sail-ipv4.us-core.com ([208.82.101.137]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_CHACHA20_POLY1305:256) (Exim 4.90_1) (envelope-from ) id 1pvnEv-00083L-8r for guix-devel@gnu.org; Sun, 07 May 2023 18:52:27 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; s=2017; bh=gloXGaBzsCbrrll cOf/pP46Wf2ksKrPqdQA5383pFe4=; h=to:subject:date:from; d=lease-up.com; b=PF3Vv8cLl5F832/piS7Z0a6lsYnwtxN6EI/6xkH5cjXocTuC8es/mZgyndyAXqME/jGI MxWLnElAPsOyrm63OgLvxQv3OFuswao1QK23o2vw2/CSqfLvJx0hof1TlfbTKLaLyqMhRS YqXIygXphNG5LvPmXeduuurol3epoMII8= Received: by sail-ipv4.us-core.com (OpenSMTPD) with ESMTPSA id 50d1732f (TLSv1.3:TLS_CHACHA20_POLY1305_SHA256:256:NO) for ; Sun, 7 May 2023 22:52:20 +0000 (UTC) Received: by mail-lj1-f173.google.com with SMTP id 38308e7fff4ca-2ac7f53ae44so43023171fa.2 for ; Sun, 07 May 2023 15:52:19 -0700 (PDT) X-Gm-Message-State: AC+VfDxbM3AH7pLbdu5tokp77UhgO2duacqVoJZxtj3UwWTbiBn+vsak cFUsXAYBu8DJ3NRVwPHqMzmOEQnMLNQLsQpB5gw= X-Google-Smtp-Source: ACHHUZ7uszCOWiLwn8+BybQ/kmL2e1xbm0irYy9ycDyZjnPwcshR5E3ludF/FDaQwedDLAKX22Wa3bwM71e96DfeeHg= X-Received: by 2002:ac2:4563:0:b0:4dd:a73f:aede with SMTP id k3-20020ac24563000000b004dda73faedemr2195003lfm.10.1683499938023; Sun, 07 May 2023 15:52:18 -0700 (PDT) MIME-Version: 1.0 Date: Sun, 7 May 2023 15:51:41 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Authenticating a custom channel while tracking upstream To: Guix Devel Content-Type: text/plain; charset="UTF-8" Received-SPF: pass client-ip=208.82.101.137; envelope-from=felix.lechner@lease-up.com; helo=sail-ipv4.us-core.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Felix Lechner From: Felix Lechner via "Development of GNU Guix and the GNU System distribution." Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: guix-devel-bounces+larch=yhetil.org@gnu.org X-Migadu-Country: US X-Migadu-Flow: FLOW_IN ARC-Seal: i=1; s=key1; d=yhetil.org; t=1683499978; a=rsa-sha256; cv=none; b=OZNFFWCWLEPEQwGM7WEDCLAIysD5RVS3zT5nPkpVXMjGiOhss3GG9vGPIhOb3AQknKSUdp 9DNQz4+P8ucMMzWDii08tz7LGJiTjaO7XbWpyiwMChsSlv6z2SI6uj7g/A8SC4CnYK/5iS vVmczM8sFuISuI70WS1S0YMJcD2161sY5Cij9frXlLWGzkSDUB21aUYpkB59HSSLYAAZxQ hkn/m1AUuYD47R9MeQ5iuS0q0LNAQZkmRCF22qkegu2E+LbK6RcJenRsTP3xArlYleT1yW 3bF+ZYawto7jiahnHb/xXV5pEZs8fybKq/fa/T3CeymSjq0WgPRJ5GcqNYyAxw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=lease-up.com header.s=2017 header.b=PF3Vv8cL; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1683499978; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=gloXGaBzsCbrrllcOf/pP46Wf2ksKrPqdQA5383pFe4=; b=pft2ADduuAMKIIN860JK5aKvO4sDgtaLJpEJy9FH+pOsARQmT8VcvzbUrZ9uKqz+JU78Sh XKa6+tJI3Sp7HIODIjLcEfKdDHISAMiTfrbHpZ+uwc6cZOwXKaZeX8ho4EO8C9R++lbHa3 wWq75ZkcCZlqezuZ1zIRlmho97DlTo7VaihaPNjx46y1j+ZRm6WffCgUndy42udOThaN7O 7kPPCF/BtHN3JkkfnRBzQGpkM+6VEd1CFGwQmiXnLSOUATmcsGcwXGeS410uXVaSDtjvXa npKQ8R0Wwtxeveox04+Unu70KSEtaO/njCwpuYgjTI69u8q38JMYead7rqbiPQ== X-Migadu-Spam-Score: -1.49 X-Spam-Score: -1.49 X-Migadu-Queue-Id: 346A245942 X-Migadu-Scanner: scn0.migadu.com Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=lease-up.com header.s=2017 header.b=PF3Vv8cL; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" X-TUID: 6V1TlFn+zY1q Hi, Is the current scheme of authenticating Git checkouts [1] really compatible with the free software guidelines we hold so dear? Here is my dilemma: I would like to deploy an experimental version of Guix by following the advice so kindly offered here [2] but hesitate to compromise on security. I cannot figure out how to add my own key [3] to the in-repo file .guix-authorizations [4] without asking an approved upstream committer to sign that commit in my own repository. The way I see it, such a shim transaction would also prevent me from tracking further upstream changes in my own branch because the shim would have to be rebased continually. I believe users should be able to extend the trust roots. Could we perhaps expand the present mechanism to merge the trusted keys from all channels? That would presumably include my own. Thanks! Kind regards Felix [1] https://guix.gnu.org/blog/2020/securing-updates/ [2] https://lists.gnu.org/archive/html/guix-devel/2023-05/msg00021.html [3] https://codeberg.org/lechner/juix/src/branch/history/.guix-authorizations [4] https://git.savannah.gnu.org/cgit/guix.git/tree/.guix-authorizations