Hi both of you (I'm replying to both at the same time),

wolf <wolf@wolfsden.cz> writes:

On 2023-09-08 11:47:56 +0200, Wojtek Kosior wrote:
> Hello Josselin
> 
> > wolf <wolf@wolfsden.cz> writes:
> > 
> > > Hmm, but the recipe for the authenticate rule comes from the (possibly)
> > > compromised source, no?  So the attacker can just modify the recipe instead of
> > > the command going the authentication.  Am I missing something?  
> > 
> > You can use a previously trusted guix to do the authentication.  `make
> > authenticate` is here for committers to check that their commits are all
> > properly signed before pushing (it's used as a pre-push hook).
> 
> From my understanding of the documentation, `make authenticate` is not
> just for committers but for all people who do a `git pull` in Guix tree
> and want to verify that the newly pulled commits do come from the
> committers. It it is not the case, then the documentation should
> probably be modified to make it clear.
> 
> The recipe is not from an untrusted source mecause the Makefile is not
> tracked by git. Rather, it gets generated when first building Guix. And
> — as the documentation instructs — the initial checkout gets
> authenticated with `guix git authenticate` rather than with `make
> authenticate` so it can't get compromised that easily.

If you've already authenticated the initial check-out, what is the point
of `make authenticate` then?  Maybe the manual isn't that clear, but as
wolf points out `make authenticate` itself cannot be a guarantee as it
requires trust in the Makefiles, creating a chicken-and-egg problem
.
> I mean, if make authenticate is just for the convenience of the committers, then
> this is completely fine.  But the documentation does not currently read that
> way.

Yes, I believe this should then be clarified.

Best,
-- 
Josselin Poiret