Re: How do I verify my hashes?

[indieterminacy <indieterminacy@libre.brussels>]

On 10-07-2022 04:12, jgart wrote:
> Hi Guixers,
> 
> Today Bonface mentioned to me that I should be cloning my packages and
> verifying the hashes with `git hash-object` or `git hash` iirc?
> 

Bonface gives very cogent demonstrations of workflow, encourage him to 
do a screencast!

> Do others do this when packaging?
> 
> My workflow currently is the lazy way:
> 
> 1. I change the version in the package definition.
> 
> 2. build the package
> 
> 3. package blows up on stdout
> 
> 4. I retrieve the hash and add it
> 
> 5. profit!
> 
> But how can I trust that computed hash?
> 
> wdyt

Im slowly moving up the value-chain with my usage of Emacs' Git 
porceline, Magit.

IMHO, the ultimate experience would be for everything operating from 
Magit's interface - for the beneficence of Guix.

> 
> Am I committing a newbie sin with the above workflow?
> 
> I know `guix refresh` exists but sometimes it is slowwww (e.g. outdated 
> *.go)
> 
> I know `make go-clean` exists but sometimes it breaks things in my 
> tree...
> 
> Should I stop worrying and just `git send-email 
> --to="guix-patches@gnu.org" -1`?
> 
> all best,
> 
> jgart

-- 
Jonathan McHugh
indieterminacy@libre.brussels