Re: GNU Guix 1.3.0rc1 available for testing!

[Maxim Cournoyer <maxim.cournoyer@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 3054 bytes --]

Hi Leo,

Leo Famulari <leo@famulari.name> writes:

> On Sat, May 01, 2021 at 01:45:57AM -0400, Maxim Cournoyer wrote:
>>     https://alpha.gnu.org/gnu/guix/guix-binary-1.3.0rc1.x86_64-linux.tar.xz
>
> I tested the binary tarball on x86_64.
>
> I used `guix package --export-manifest > manifest` before beginning the
> test, so that I could easily recreate my profile afterwards.
>
>> All these files have an associated ‘.sig’, an OpenPGP signature that you
>> can verify as explained at
>> <https://guix.gnu.org/manual/en/html_node/Binary-Installation.html>.
>
> These instructions explain how to get Ludo's key, but that wasn't used
> here.
>
> In doc/guix.texi, the variables OPENPGP-SIGNING-KEY-ID and
> OPENPGP-SIGNING-KEY-URL are defined.
>
> Maybe we should update the manual to mention "1.3.0rc1" and the correct
> key.
>
> The "normal" manual would still mention 1.2.0, but the devel manual
> would work for 1.3.0rc1. I think that it's fine to mention the release
> candidate in the "devel" manual.
>
> https://guix.gnu.org/manual/en/
> https://guix.gnu.org/manual/devel/en/

Thank you for pointing that issue; I caught the problem with
guix-install.sh before posting, but overlooked that one.  As you
pointed, that won't be reflected on our website, but I agree that having
the new key covered in the devel manual (master branch) is already an
improvement.  The attached patch augments the manual to cover for the
new key.  Let me know if it looks good to you.  If it does, I will push
it to the master branch (IIUC we can't push this change to the
version-1.3.0 branch as that would break the string freeze there).

>>
>>   1. Testing the binary tarball on the distro of your choice.  You can
>>      download <https://guix.gnu.org/install.sh>.  Uncomment the
>>      ‘GNU_URL’ variable assignment that refers to alpha.gnu.org and it
>>      should pick up 1.3.0rc1 automatically.
>
> The install.sh script also recommends installing Ludo's key, but of
> course fails to verify the signature with it. After installing Ludo's
> key, the installer does suggest the correct key — Maxim's.

Are you sure you downloaded it from https://guix.gnu.org/install.sh
(which just redirects to the current copy on the master branch) ?  Since
commit e64af2060e8cfa48e74b887281acb3fd4c7e7781 (which was made just
before writing the original message), it checks for both keys.

> Aside from that, the install.sh script worked fine on current Debian,
> and I was able to conveniently restore my Guix profile with `guix
> package -m ./manifest`.
>
> Then I did `guix pull && guix upgrade`. All good!
>
> I forgot to remove the existing Guix build users and the guixbuild group
> before my test. It would be great if somebody can remember to check that
> they are created successfully by the script.

I've tested the install script in a Ubuntu 20.04 VM which had never
known Guix, and it was successful.  I guess that part is covered :-).

Thanks for the tests and feedback!

Maxim

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-doc-Update-to-cover-for-an-additional-OpenPGP-signin.patch --]
[-- Type: text/x-patch, Size: 3283 bytes --]

From 3b942cb833688520c4c4dadfb281270520510564 Mon Sep 17 00:00:00 2001
From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Date: Sat, 1 May 2021 22:35:09 -0400
Subject: [PATCH] doc: Update to cover for an additional OpenPGP signing key.

The upcoming 1.3.0 release will be signed with my OpenPGP key, and further
releases may also be.

* doc/guix.texi (OPENPGP-SIGNING-KEY-ID, OPENPGP-SIGNING-KEY-URL): Rename to...
(OPENPGP-SIGNING-KEY-ID-1, OPENPGP-SIGNING-KEY-URL-1): ... these,
respectively.
(OPENPGP-SIGNING-KEY-ID-2, OPENPGP-SIGNING-KEY-URL-2): New variables.
(Binary Installation): Adjust to cover for the new key.
(USB Stick and DVD Installation): Likewise.
(Invoking guix refresh): Adjust accordingly.
---
 doc/guix.texi | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 2fe7ad3a2a..b1bb0db74d 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -9,9 +9,11 @@
 
 @include version.texi
 
-@c Identifier of the OpenPGP key used to sign tarballs and such.
-@set OPENPGP-SIGNING-KEY-ID 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
-@set OPENPGP-SIGNING-KEY-URL https://sv.gnu.org/people/viewgpg.php?user_id=15145
+@c Identifier of the OpenPGP keys used to sign tarballs and such.
+@set OPENPGP-SIGNING-KEY-ID-1 3CE464558A84FDC69DB40CFB090B11993D9AEBB5 @c ludo
+@set OPENPGP-SIGNING-KEY-URL-1 https://sv.gnu.org/people/viewgpg.php?user_id=15145
+@set OPENPGP-SIGNING-KEY-ID-2 27D586A4F8900854329FF09F1260E46482E63562 @c maxim
+@set OPENPGP-SIGNING-KEY-URL-2 https://sv.gnu.org/people/viewgpg.php?user_id=127547
 
 @c Base URL for downloads.
 @set BASE-URL https://ftp.gnu.org/gnu/guix
@@ -649,11 +651,13 @@ $ wget @value{BASE-URL}/guix-binary-@value{VERSION}.x86_64-linux.tar.xz.sig
 $ gpg --verify guix-binary-@value{VERSION}.x86_64-linux.tar.xz.sig
 @end example
 
-If that command fails because you do not have the required public key,
-then run this command to import it:
+If that command fails because you do not have the required public keys,
+then run these commands to import them:
 
 @example
-$ wget '@value{OPENPGP-SIGNING-KEY-URL}' \
+$ wget '@value{OPENPGP-SIGNING-KEY-URL-1}' \
+      -qO - | gpg --import -
+$ wget '@value{OPENPGP-SIGNING-KEY-URL-2}' \
       -qO - | gpg --import -
 @end example
 
@@ -2119,11 +2123,13 @@ $ wget @value{BASE-URL}/guix-system-install-@value{VERSION}.x86_64-linux.iso.xz.
 $ gpg --verify guix-system-install-@value{VERSION}.x86_64-linux.iso.xz.sig
 @end example
 
-If that command fails because you do not have the required public key,
-then run this command to import it:
+If that command fails because you do not have the required public keys,
+then run these commands to import them:
 
 @example
-$ wget @value{OPENPGP-SIGNING-KEY-URL} \
+$ wget @value{OPENPGP-SIGNING-KEY-URL-1} \
+      -qO - | gpg --import -
+$ wget @value{OPENPGP-SIGNING-KEY-URL-2} \
       -qO - | gpg --import -
 @end example
 
@@ -11912,7 +11918,7 @@ Likewise, you can fetch keys to a specific keybox file like this:
 
 @example
 gpg --no-default-keyring --keyring mykeyring.kbx \
-  --recv-keys @value{OPENPGP-SIGNING-KEY-ID}
+  --recv-keys @value{OPENPGP-SIGNING-KEY-ID-1}
 @end example
 
 @xref{GPG Configuration Options, @option{--keyring},, gnupg, Using the GNU
-- 
2.31.1