[bug#62411] [PATCH] environment: Add '--nesting'.

[bug#62411] [PATCH] environment: Add '--nesting'.

[Ludovic Courtès]

From: Ludovic Courtès <ludovic.courtes@inria.fr>

* guix/scripts/environment.scm (show-environment-options-help)
(%options): Add '--nesting'.
(options/resolve-packages): Handle it.
(launch-environment/container): Add #:nesting? and honor it.
[nesting-mappings]: New procedure.
(guix-environment*): Add support for '--nesting'.
* guix/scripts/shell.scm (profile-cached-gc-root): Special-case
'nesting?'.
* tests/guix-environment-container.sh: Test it.
* doc/guix.texi (Invoking guix shell): Document it.
---
 doc/guix.texi                       | 41 ++++++++++++++++++
 guix/scripts/environment.scm        | 66 +++++++++++++++++++++++++++--
 guix/scripts/shell.scm              |  2 +
 tests/guix-environment-container.sh |  9 ++++
 4 files changed, 114 insertions(+), 4 deletions(-)

Hi there!

Recently, Konrad came up with a concrete use case for “nested”
‘guix shell’ containers:

  https://lists.gnu.org/archive/html/guix-devel/2023-02/msg00027.html

Setting up nested containers was doable but tedious and brittle,
so a better option seemed to offer support for that:

  https://lists.gnu.org/archive/html/guix-devel/2023-02/msg00275.html

This is what this patch does with the new ‘--nesting’ or ‘-W’ option.
Here’s a somewhat extreme example using ‘guix shell’ with this patch
to create a container, inside which we run ‘guix time-machine’:

--8<---------------cut here---------------start------------->8---
$ guix time-machine --url=$HOME/src/guix --branch=wip-shell-nested-containers \
    -- shell -CWN coreutils nss-certs \
    -- guix time-machine -- describe
  guix 086f27c
    repository URL: https://git.savannah.gnu.org/git/guix.git
    branch: master
    commit: 086f27cf8cb4198d15d7d65c8703d50b58ab3c03
--8<---------------cut here---------------end--------------->8---

Creating a container with only ‘coreutils’ and ‘guix’, and within which
we create another container with nothing but ‘coreutils-minimal’:

--8<---------------cut here---------------start------------->8---
$ guix time-machine --url=$HOME/src/guix --branch=wip-shell-nested-containers \
     -- shell -CW coreutils \
     -- guix shell -C coreutils-minimal \
     -- ls -l /gnu/store
total 40
dr-xr-xr-x  5 65534 overflow 4096 Jan  1  1970 094bbaq6glba86h1d4cj16xhdi6fk2jl-gcc-10.3.0-lib
dr-xr-xr-x 10 65534 overflow 4096 Jan  1  1970 5h2w4qi9hk1qzzgi1w83220ydslinr4s-glibc-2.33
dr-xr-xr-x  4 65534 overflow 4096 Jan  1  1970 720rj90bch716isd8z7lcwrnvz28ap4y-bash-static-5.1.8
dr-xr-xr-x  7 65534 overflow 4096 Jan  1  1970 9rrnm5hdjw7cy96a2a9rfgh6y08wsbmf-ncurses-6.2.20210619
dr-xr-xr-x  6 65534 overflow 4096 Jan  1  1970 d99ykvj3axzzidygsmdmzxah4lvxd6hw-bash-5.1.8
dr-xr-xr-x  3 65534 overflow 4096 Jan  1  1970 ifscrw9mbn79lyq4ac91yb973n7v94ww-emacs-subdirs
dr-xr-xr-x  4 65534 overflow 4096 Jan  1  1970 lk9ihkbmbl372nq5xya691qfmgmyy7l5-profile
dr-xr-xr-x  3 65534 overflow 4096 Jan  1  1970 phkd1186xafw1yy7s3jv353p4vbinmmq-info-dir
dr-xr-xr-x  6 65534 overflow 4096 Jan  1  1970 vqdsrvs9jbn0ix2a58s99jwkh74124y5-coreutils-minimal-8.32
dr-xr-xr-x  6 65534 overflow 4096 Jan  1  1970 wcwls45278gzpjvwlvrrs1y7h30g44xh-readline-8.1.1
--8<---------------cut here---------------end--------------->8---

Well, you get the idea.

Notice that the current Guix is automatically added to the container:

--8<---------------cut here---------------start------------->8---
$ guix time-machine --url=$HOME/src/guix --branch=wip-shell-nested-containers \
     -- describe
  guix a67dda7
    repository URL: /home/ludo/src/guix
    branch: wip-shell-nested-containers
    commit: a67dda77290b6fdca53fcfa50ab7382e62090932
$ guix time-machine --url=$HOME/src/guix --branch=wip-shell-nested-containers \
     -- shell -CW coreutils \
     -- guix describe
  guix a67dda7
    repository URL: /home/ludo/src/guix
    branch: wip-shell-nested-containers
    commit: a67dda77290b6fdca53fcfa50ab7382e62090932
--8<---------------cut here---------------end--------------->8---

Furthermore, ~/.cache/guix is shared with the host as noted in
the manual.

Thoughts?

Ludo’.

diff --git a/doc/guix.texi b/doc/guix.texi
index fa1f46c2b1..739ab45570 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -6337,6 +6337,47 @@ cache (contrary to glibc in regular Guix usage) and set up the
 expected FHS directories: @file{/bin}, @file{/etc}, @file{/lib}, and
 @file{/usr} from the container's profile.
 
+@cindex nested containers, for @command{guix shell}
+@cindex container nesting, for @command{guix shell}
+@item --nesting
+@itemx -W
+When used with @option{--container}, provide Guix @emph{inside} the
+container and arrange so that it can interact with the build daemon that
+runs outside the container.  This is useful if you want, within your
+isolated container, to create other containers, as in this sample
+session:
+
+@example
+$ guix shell -CW coreutils
+[env]$ guix shell -C guile -- guile -c '(display "hello!\n")'
+hello!
+[env]$ exit
+@end example
+
+The session above starts a container with @code{coreutils} programs
+available in @env{PATH}.  From there, we spawn @command{guix shell} to
+create a @emph{nested} container that provides nothing but Guile.
+
+Under the hood, this option does several things:
+
+@itemize
+@item
+map the daemon's socket (by default
+@file{/var/guix/daemon-socket/socket}) inside the container;
+@item
+map the whole store (by default @file{/gnu/store}) inside the container
+such that store items made available by nested @command{guix}
+invocations are visible;
+@item
+add the currently-used @command{guix} command to the profile in the
+container, such that @command{guix describe} returns the same state
+inside and outside the container;
+@item
+share the cache (by default @file{~/.cache/guix}) with the host, to
+speed up operations such as @command{guix time-machine} and
+@command{guix shell}.
+@end itemize
+
 @item --rebuild-cache
 @cindex caching, of profiles
 @cindex caching, in @command{guix shell}
diff --git a/guix/scripts/environment.scm b/guix/scripts/environment.scm
index a4939ea63c..ebfc05731c 100644
--- a/guix/scripts/environment.scm
+++ b/guix/scripts/environment.scm
@@ -31,6 +31,8 @@ (define-module (guix scripts environment)
   #:use-module (guix build utils)
   #:use-module (guix monads)
   #:use-module ((guix gexp) #:select (lower-object))
+  #:autoload   (guix describe) (current-profile current-channels)
+  #:autoload   (guix channels) (guix-channel? channel-commit)
   #:use-module (guix scripts)
   #:use-module (guix scripts build)
   #:autoload   (guix scripts pack) (symlink-spec-option-parser)
@@ -49,9 +51,11 @@ (define-module (guix scripts environment)
   #:autoload   (gnu packages) (specification->package+output)
   #:autoload   (gnu packages bash) (bash)
   #:autoload   (gnu packages bootstrap) (bootstrap-executable %bootstrap-guile)
+  #:autoload   (gnu packages package-management) (guix)
   #:use-module (ice-9 match)
   #:autoload   (ice-9 rdelim) (read-line)
   #:use-module (ice-9 vlist)
+  #:autoload   (web uri) (string->uri uri-scheme)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-11)
   #:use-module (srfi srfi-26)
@@ -108,6 +112,8 @@ (define (show-environment-options-help)
   -P, --link-profile     link environment profile to ~/.guix-profile within
                          an isolated container"))
   (display (G_ "
+  -W, --nesting          make Guix available within the container"))
+  (display (G_ "
   -u, --user=USER        instead of copying the name and home of the current
                          user into an isolated container, use the name USER
                          with home directory /home/USER"))
@@ -238,6 +244,9 @@ (define %options
          (option '(#\N "network") #f #f
                  (lambda (opt name arg result)
                    (alist-cons 'network? #t result)))
+         (option '(#\W "nesting") #f #f
+                 (lambda (opt name arg result)
+                   (alist-cons 'nesting? #t result)))
          (option '(#\P "link-profile") #f #f
                  (lambda (opt name arg result)
                    (alist-cons 'link-profile? #t result)))
@@ -342,6 +351,26 @@ (define (packages->outputs packages mode)
                      (packages->outputs (load* file module) mode)))
                   (('manifest . file)
                    (manifest-entries (load-manifest file)))
+                  (('nesting? . #t)
+                   (if (assoc-ref opts 'profile)
+                       '()
+                       (let ((profile (and=> (current-profile) readlink*)))
+                         (if (or (not profile) (not (store-path? profile)))
+                             (begin
+                               (warning (G_ "\
+could not add current Guix to the profile~%"))
+                               '())
+                             (list (manifest-entry
+                                     (name "guix")
+                                     (version
+                                      (or (any (lambda (channel)
+                                                 (and (guix-channel? channel)
+                                                      (channel-commit channel)))
+                                               (current-channels))
+                                          "0"))
+                                     (item profile)
+                                     (search-paths
+                                      (package-native-search-paths guix))))))))
                   (_ '()))
                 opts)
     manifest-entry=?)))
@@ -688,7 +717,8 @@ (define* (launch-environment/fork command profile manifest
 
 (define* (launch-environment/container #:key command bash user user-mappings
                                        profile manifest link-profile? network?
-                                       map-cwd? emulate-fhs? (setup-hook #f)
+                                       map-cwd? emulate-fhs? nesting?
+                                       (setup-hook #f)
                                        (symlinks '()) (white-list '()))
   "Run COMMAND within a container that features the software in PROFILE.
 Environment variables are set according to the search paths of MANIFEST.  The
@@ -704,6 +734,9 @@ (define* (launch-environment/container #:key command bash user user-mappings
 SETUP-HOOK is an additional setup procedure to be called, currently only used
 with the EMULATE-FHS? option.
 
+When NESTING? is true, share all the store with the container and add Guix to
+its profile, allowing its use from within the container.
+
 LINK-PROFILE? creates a symbolic link from ~/.guix-profile to the
 environment profile.
 
@@ -731,8 +764,26 @@ (define fhs-mappings
            ("/libexec" . "/usr/libexec")
            ("/share"   . "/usr/share"))))
 
-  (mlet %store-monad ((reqs (inputs->requisites
-                             (list (direct-store-path bash) profile))))
+  (define (nesting-mappings)
+    ;; Files shared with the host when enabling nesting.
+    (cons* (file-system-mapping
+            (source (%store-prefix))
+            (target source))
+           (file-system-mapping
+            (source (cache-directory))
+            (target source)
+            (writable? #t))
+           (let ((uri (string->uri (%daemon-socket-uri))))
+             (if (or (not uri) (eq? 'file (uri-scheme uri)))
+                 (list (file-system-mapping
+                        (source (%daemon-socket-uri))
+                        (target source)))
+                 '()))))
+
+  (mlet %store-monad ((reqs (if nesting?
+                                (return '())
+                                (inputs->requisites
+                                 (list (direct-store-path bash) profile)))))
     (return
      (let* ((cwd      (getcwd))
             (home     (getenv "HOME"))
@@ -795,11 +846,14 @@ (define fhs-mappings
                                       (filter-map optional-mapping->fs
                                                   %network-file-mappings)
                                       '())
-                                  ;; Mappings for an FHS container.
                                   (if emulate-fhs?
                                       (filter-map optional-mapping->fs
                                                   fhs-mappings)
                                       '())
+                                  (if nesting?
+                                      (filter-map optional-mapping->fs
+                                                  (nesting-mappings))
+                                      '())
                                   (map file-system-mapping->bind-mount
                                        mappings))))
        (exit/status
@@ -1013,6 +1067,7 @@ (define (guix-environment* opts)
          (network?     (assoc-ref opts 'network?))
          (no-cwd?      (assoc-ref opts 'no-cwd?))
          (emulate-fhs? (assoc-ref opts 'emulate-fhs?))
+         (nesting?     (assoc-ref opts 'nesting?))
          (user         (assoc-ref opts 'user))
          (bootstrap?   (assoc-ref opts 'bootstrap?))
          (system       (assoc-ref opts 'system))
@@ -1059,6 +1114,8 @@ (define-syntax-rule (with-store/maybe store exp ...)
         (leave (G_ "--no-cwd cannot be used without '--container'~%")))
       (when emulate-fhs?
         (leave (G_ "'--emulate-fhs' cannot be used without '--container~%'")))
+      (when nesting?
+        (leave (G_ "'--nesting' cannot be used without '--container~%'")))
       (when (pair? symlinks)
         (leave (G_ "'--symlink' cannot be used without '--container~%'"))))
 
@@ -1141,6 +1198,7 @@ (define manifest
                                                   #:network? network?
                                                   #:map-cwd? (not no-cwd?)
                                                   #:emulate-fhs? emulate-fhs?
+                                                  #:nesting? nesting?
                                                   #:symlinks symlinks
                                                   #:setup-hook
                                                   (and emulate-fhs?
diff --git a/guix/scripts/shell.scm b/guix/scripts/shell.scm
index 92bbfb04d0..1b42cc2af0 100644
--- a/guix/scripts/shell.scm
+++ b/guix/scripts/shell.scm
@@ -389,6 +389,8 @@ (define (key->file key)
        (if (not file)
            (loop rest system file (cons spec specs))
            (values #f #f)))
+      ((('nesting? . #t) . rest)
+       (loop rest system file (append specs '("nested guix"))))
       ((('load . ('package candidate)) . rest)
        (if (and (not file) (null? specs))
            (loop rest system candidate specs)
diff --git a/tests/guix-environment-container.sh b/tests/guix-environment-container.sh
index 0475405a89..a30d6b7fb2 100644
--- a/tests/guix-environment-container.sh
+++ b/tests/guix-environment-container.sh
@@ -264,3 +264,12 @@ guix shell --bootstrap guile-bootstrap --container \
 
 # An invalid symlink spec causes the command to fail.
 ! guix shell --bootstrap -CS bin/guile=/usr/bin/guile guile-bootstrap -- exit
+
+# Check whether '--nesting' works.
+guix build hello -d
+env="$(type -P pre-inst-env)"
+if guix shell -C -D guix -- "$env" guix build hello -d # cannot work
+then false; else true; fi
+hello_drv="$(guix build hello -d)"
+hello_drv_nested="$(cd "$(dirname env)" && guix shell --bootstrap -CW -D guix -- "$env" guix build hello -d)"
+test "$hello_drv" = "$hello_drv_nested"

base-commit: 2120c768f2366c92d72d15e4044a81c31e57688b
-- 
2.39.2

[bug#62411] [PATCH] environment: Add '--nesting'.

[Konrad Hinsen via Guix-patches]

Ludovic Courtès <ludo@gnu.org> writes:

> Notice that the current Guix is automatically added to the container:

"Current Guix" is good news!

> Furthermore, ~/.cache/guix is shared with the host as noted in
> the manual.

That is very nice as well, for efficient time-machine.

> Thoughts?

The two points above, plus the automatic sharing of the daemon socket,
cover the main drawbacks of the workaround I have been using so far.
So... this looks good to me. I'd be happy to test-drive the patch on my
examples, but that will have to wait for next week.

Cheers,
  Konrad.
-- 
---------------------------------------------------------------------
Konrad Hinsen
Centre de Biophysique Moléculaire, CNRS Orléans
Synchrotron Soleil - Division Expériences
Saint Aubin - BP 48
91192 Gif sur Yvette Cedex, France
Tel. +33-1 69 35 97 15
E-Mail: konrad DOT hinsen AT cnrs DOT fr
http://dirac.cnrs-orleans.fr/~hinsen/
ORCID: https://orcid.org/0000-0003-0330-9428
Mastodon: @khinsen@scholar.social
---------------------------------------------------------------------

[bug#62411] [PATCH] environment: Add '--nesting'.

[Ludovic Courtès]

Hello,

Konrad Hinsen <konrad.hinsen@cnrs.fr> skribis:

> The two points above, plus the automatic sharing of the daemon socket,
> cover the main drawbacks of the workaround I have been using so far.
> So... this looks good to me. I'd be happy to test-drive the patch on my
> examples, but that will have to wait for next week.

Awesome.  Note that it can only add the current Guix to the environment
if you’re running Guix “the regular way” (i.e., not ./pre-inst-env).
That’s why I used ‘time-machine’ for my tests above.

Thanks for your feedback!

Ludo’.

[bug#62411] [PATCH] environment: Add '--nesting'.

[Konrad Hinsen]

Hi Ludo,

> Awesome.  Note that it can only add the current Guix to the environment
> if you’re running Guix “the regular way” (i.e., not ./pre-inst-env).
> That’s why I used ‘time-machine’ for my tests above.

Good to know, thanks!

I don't have a branch wip-shell-nested-containers after 'git fetch
–all'.  And I can't find the branch wip-shell-nested-containers at
savannah.  Did you push it?

Cheers,
  Konrad
-- 
---------------------------------------------------------------------
Konrad Hinsen
Centre de Biophysique Moléculaire, CNRS Orléans
Synchrotron Soleil - Division Expériences
Saint Aubin - BP 48
91192 Gif sur Yvette Cedex, France
Tel. +33-1 69 35 97 15
E-Mail: konrad DOT hinsen AT cnrs DOT fr
http://dirac.cnrs-orleans.fr/~hinsen/
ORCID: https://orcid.org/0000-0003-0330-9428
Mastodon: @khinsen@scholar.social
---------------------------------------------------------------------

[bug#62411] [PATCH] environment: Add '--nesting'.

[Ludovic Courtès]

Hi,

Konrad Hinsen <konrad.hinsen@cnrs.fr> skribis:

> I don't have a branch wip-shell-nested-containers after 'git fetch
> –all'.  And I can't find the branch wip-shell-nested-containers at
> savannah.  Did you push it?

I didn’t, but you can create it locally with the patch (that’s what I
did).

HTH!

Ludo’.

[bug#62411] [PATCH] environment: Add '--nesting'.

[Konrad Hinsen]

Ludovic Courtès <ludovic.courtes@inria.fr> writes:

> I didn’t, but you can create it locally with the patch (that’s what I
> did).

Good point. Some Web searches later... Done!

Except that I must have missed something:

  $ guix time-machine --url=$HOME/src/guix --branch=wip-nested-containers -- shell -C -W -N make bash -- make all
  Updating channel 'guix' from Git repository at '/home/hinsen/src/guix'...
  guix time-machine: error: Git error: cannot locate remote-tracking
  branch 'origin/keyring'

The name "keyring" suggests that this is related to authentication, but
I have no idea what to do about this!

Cheers,
  Konrad
-- 
---------------------------------------------------------------------
Konrad Hinsen
Centre de Biophysique Moléculaire, CNRS Orléans
Synchrotron Soleil - Division Expériences
Saint Aubin - BP 48
91192 Gif sur Yvette Cedex, France
Tel. +33-1 69 35 97 15
E-Mail: konrad DOT hinsen AT cnrs DOT fr
http://dirac.cnrs-orleans.fr/~hinsen/
ORCID: https://orcid.org/0000-0003-0330-9428
Mastodon: @khinsen@scholar.social
---------------------------------------------------------------------

[bug#62411] [PATCH] environment: Add '--nesting'.

[Ludovic Courtès]

Konrad Hinsen <konrad.hinsen@cnrs.fr> skribis:

> Except that I must have missed something:
>
>   $ guix time-machine --url=$HOME/src/guix --branch=wip-nested-containers -- shell -C -W -N make bash -- make all
>   Updating channel 'guix' from Git repository at '/home/hinsen/src/guix'...
>   guix time-machine: error: Git error: cannot locate remote-tracking
>   branch 'origin/keyring'

Maybe you need to run ‘git fetch’ and/or make sure the remote is called
“origin”?

> I worked around this using --disable-authentication, but I don't
> understand what's going wrong. My repository is a clone of the official
> repository at Savannah, and it does have a branch "origin/keyring".

Weird.  (You would have needed ‘--disable-authentication’ anyway, now
that I think about it, because the commit signed by you would have been
considered “inauthentic”.)

> The patch works as expected for me. I could simplify the instructions
> for running my example Makefile from
>
>    guix shell -C -N make bash guix nss-certs \
>        --expose=/var/guix/daemon-socket/socket \
>        --expose=/gnu/store \
>        -- make all
>
> to:
>
>    guix shell -C -W -N make bash \
>        -- make all
>
> and. more importantly, require much less explanation of ugly
> technicalities.

Yay!

> The full Makefile is attached for illustrating the context in which I
> (intend to) use this new feature. I use time-machine inside the recipes
> of my Makefile, in order to make them fully reproducible. This used to
> be a very expensive operation without the patch, because the
> time-machine in the container did not have access to the global cache on
> the host system. It is a lot faster now.
>
> So... where is the "like" button?  ;-)

Click here ➡ 👍 ⬅

Thanks a lot for testing!  If there are no further comments, I’ll push
it within a couple of days.

Ludo’.

[bug#62411] [PATCH] environment: Add '--nesting'.

[Konrad Hinsen]

Ludovic Courtès <ludovic.courtes@inria.fr> writes:

>> Except that I must have missed something:
>>
>>   $ guix time-machine --url=$HOME/src/guix --branch=wip-nested-containers -- shell -C -W -N make bash -- make all
>>   Updating channel 'guix' from Git repository at '/home/hinsen/src/guix'...
>>   guix time-machine: error: Git error: cannot locate remote-tracking
>>   branch 'origin/keyring'
>
> Maybe you need to run ‘git fetch’ and/or make sure the remote is called
> “origin”?

I had already checked both - everything is fine.

> Weird.  (You would have needed ‘--disable-authentication’ anyway, now
> that I think about it, because the commit signed by you would have been
> considered “inauthentic”.)

I am worse than inauthentic: I don't even sign my commits ;-)

>> So... where is the "like" button?  ;-)
>
> Click here ➡ 👍 ⬅

Click - click - click...

> Thanks a lot for testing!  If there are no further comments, I’ll push
> it within a couple of days.

Great!

Thanks a lot,
  Konrad.
-- 
---------------------------------------------------------------------
Konrad Hinsen
Centre de Biophysique Moléculaire, CNRS Orléans
Synchrotron Soleil - Division Expériences
Saint Aubin - BP 48
91192 Gif sur Yvette Cedex, France
Tel. +33-1 69 35 97 15
E-Mail: konrad DOT hinsen AT cnrs DOT fr
http://dirac.cnrs-orleans.fr/~hinsen/
ORCID: https://orcid.org/0000-0003-0330-9428
Mastodon: @khinsen@scholar.social
---------------------------------------------------------------------

[bug#62411] [PATCH] environment: Add '--nesting'.

[Ludovic Courtès]

Hello!

Pushed as 57db09aae73e3713a10c5253758d84e1046f80dc!

I added another example in the manual and followed up with an entry in
‘etc/news.scm’ (which I should have posted here earlier to make things
easier for translators—sorry about that!).

Ludo’.

[bug#62411] [PATCH] environment: Add '--nesting'.

[Simon Tournier]

Hi Ludo,

On mar., 28 mars 2023 at 15:50, Ludovic Courtès <ludovic.courtes@inria.fr> wrote:

> Weird.  (You would have needed ‘--disable-authentication’ anyway, now
> that I think about it, because the commit signed by you would have been
> considered “inauthentic”.)

I always need to disable authentication, for example:

    https://issues.guix.gnu.org/issue/59974#1
    https://yhetil.org/guix/86a63nveib.fsf@gmail.com

which exposes command lines something like that:

--8<---------------cut here---------------start------------->8---
guix time-machine --branch=issue-59974                                        \
                  --commit=749c8e6d07caeb46f7686a705e62726214558bb1           \
                  --url=https://git.guix-patches.cbaines.net/git/guix-patches \
                  --disable-authentication                                    \
     -- shell mygnuhealth                                                     \
     -- mygnuhealth
--8<---------------cut here---------------end--------------->8---


Cheers,
simon

[bug#62411] [PATCH] environment: Add '--nesting'.

[Ludovic Courtès]

Hi,

Simon Tournier <zimon.toutoune@gmail.com> skribis:

> I always need to disable authentication, for example:
>
>     https://issues.guix.gnu.org/issue/59974#1
>     https://yhetil.org/guix/86a63nveib.fsf@gmail.com

That’s because the ‘issue-NNN’ branches include unsigned commits I
suppose (which makes sense, because they’re created automatically).

Ludo’.