bug#41764: `make authenticate` fails to find the keyring branch

bug#41764: `make authenticate` fails to find the keyring branch

[Leo Famulari]

I just tried pushing for the first time since installing the new
pre-push hook that runs `make authenticate`.

This failed with the following error:

Git error: cannot locate remote-tracking branch 'keyring'

However, `git branch --all` includes "remotes/origin/keyring".

After I did `git checkout origin/keyring`, it worked.

Let's update the manual section Commit Access with the recommended way
to make this branch accessible to `make authenticate`. Maybe it should
even do it automatically?

bug#41764: `make authenticate` fails to find the keyring branch

[Ludovic Courtès]

Hi,

Leo Famulari <leo@famulari.name> skribis:

> I just tried pushing for the first time since installing the new
> pre-push hook that runs `make authenticate`.
>
> This failed with the following error:
>
> Git error: cannot locate remote-tracking branch 'keyring'
>
> However, `git branch --all` includes "remotes/origin/keyring".
>
> After I did `git checkout origin/keyring`, it worked.

Right, since commit 512b9e2da26968ebafdd47f701edd8fc3936d3e8, you have
to have a local ‘keyring’ branch.

> Let's update the manual section Commit Access with the recommended way
> to make this branch accessible to `make authenticate`. Maybe it should
> even do it automatically?

I don’t think it can do it automatically because it cannot guess what
the remote is called (Tobias reported an issue earlier because
“origin/keyring” was hard-coded and Tobias didn’t have an “origin”
remote.)

Regarding documentation, do you think it would suffice to say that one
needs to have a local ‘keyring’ branch tracking upstream’s?

Thanks,
Ludo’.

bug#41764: `make authenticate` fails to find the keyring branch

[Miguel Ángel Arruga Vivas]

[-- Attachment #1.1: Type: text/plain, Size: 1733 bytes --]

Hi,

Ludovic Courtès <ludo@gnu.org> writes:
> Hi,
>
> Leo Famulari <leo@famulari.name> skribis:
>
>> I just tried pushing for the first time since installing the new
>> pre-push hook that runs `make authenticate`.
>>
>> This failed with the following error:
>>
>> Git error: cannot locate remote-tracking branch 'keyring'
>>
>> However, `git branch --all` includes "remotes/origin/keyring".
>>
>> After I did `git checkout origin/keyring`, it worked.
>
> Right, since commit 512b9e2da26968ebafdd47f701edd8fc3936d3e8, you have
> to have a local ‘keyring’ branch.

I've hit this too...

>> Let's update the manual section Commit Access with the recommended way
>> to make this branch accessible to `make authenticate`. Maybe it should
>> even do it automatically?
>
> I don’t think it can do it automatically because it cannot guess what
> the remote is called (Tobias reported an issue earlier because
> “origin/keyring” was hard-coded and Tobias didn’t have an “origin”
> remote.)

I'd say this isn't really a solution: hard-coding the origin is bad but
not the branch name?  Someone who wants to have a local branch called
keyring for whatever reason will have the exact same problem.

From my POV, "origin/keyring" should be the *default*, as only people
modifying its contents should have a local branch pointing to it, but
the moment you name it hard- instead of normal-code you can clearly say
there's a configuration need. :-)

The attached patch exposes a variable for make called GUIX_GIT_KEYRING
to provide the keyring reference to guix git authenticate, including an
example in the manual, as everything else is already there.  WDYT?

Happy hacking!
Miguel


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: 0001-build-Add-GUIX_GIT_KEYRING-variable-for-make-authent.patch --]
[-- Type: text/x-patch, Size: 2116 bytes --]

From 479ac6846cb228b67b778965f0f5299ea3172424 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miguel=20=C3=81ngel=20Arruga=20Vivas?=
 <rosen644835@gmail.com>
Date: Sat, 24 Oct 2020 14:35:09 +0200
Subject: [PATCH] build: Add GUIX_GIT_KEYRING variable for make authenticate.

* Makefile.am (GUIX_GIT_KEYRING): New variable.
(authenticate): Use GUIX_GIT_KEYRING to select the keyring branch
reference.
* doc/contributing.texi (Building from Git): Add an example about the
use of GUIX_GIT_KEYRING.
---
 Makefile.am           |  2 ++
 doc/contributing.texi | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/Makefile.am b/Makefile.am
index c509562567..e6cef9ec1a 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -666,9 +666,11 @@ channel_intro_commit = 9edb3f66fd807b096b48283debdcddccfea34bad
 channel_intro_signer = BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA
 
 # Authenticate the current Git checkout by checking signatures on every commit.
+GUIX_GIT_KEYRING = origin/keyring
 authenticate:
 	$(AM_V_at)echo "Authenticating Git checkout..." ;	\
 	guix git authenticate					\
+	    --keyring=$(GUIX_GIT_KEYRING)			\
 	    --cache-key=channels/guix --stats			\
 	    "$(channel_intro_commit)" "$(channel_intro_signer)"
 
diff --git a/doc/contributing.texi b/doc/contributing.texi
index 26a4627464..9312faa849 100644
--- a/doc/contributing.texi
+++ b/doc/contributing.texi
@@ -140,6 +140,16 @@ make authenticate
 
 The first run takes a couple of minutes, but subsequent runs are faster.
 
+Or, when your configuration for your local git repository doesn't match
+the default one, you can provide the reference for the @code{keyring}
+branch through the variable @code{GUIX_GIT_KEYRING}.  The following
+example assumes that you have a git remote called @samp{myremote}
+pointing to the official repository:
+
+@example
+make authenticate GUIX_GIT_KEYRING=myremote/keyring
+@end example
+
 @quotation Note
 You are advised to run @command{make authenticate} after every
 @command{git pull} invocation.  This ensures you keep receiving valid
-- 
2.28.0


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 658 bytes --]

bug#41764: `make authenticate` fails to find the keyring branch

[Ludovic Courtès]

Hi!

Miguel Ángel Arruga Vivas <rosen644835@gmail.com> skribis:

> From 479ac6846cb228b67b778965f0f5299ea3172424 Mon Sep 17 00:00:00 2001
> From: =?UTF-8?q?Miguel=20=C3=81ngel=20Arruga=20Vivas?=
>  <rosen644835@gmail.com>
> Date: Sat, 24 Oct 2020 14:35:09 +0200
> Subject: [PATCH] build: Add GUIX_GIT_KEYRING variable for make authenticate.
>
> * Makefile.am (GUIX_GIT_KEYRING): New variable.
> (authenticate): Use GUIX_GIT_KEYRING to select the keyring branch
> reference.
> * doc/contributing.texi (Building from Git): Add an example about the
> use of GUIX_GIT_KEYRING.
> ---
>  Makefile.am           |  2 ++
>  doc/contributing.texi | 10 ++++++++++
>  2 files changed, 12 insertions(+)
>
> diff --git a/Makefile.am b/Makefile.am
> index c509562567..e6cef9ec1a 100644
> --- a/Makefile.am
> +++ b/Makefile.am
> @@ -666,9 +666,11 @@ channel_intro_commit = 9edb3f66fd807b096b48283debdcddccfea34bad
>  channel_intro_signer = BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA
>  
>  # Authenticate the current Git checkout by checking signatures on every commit.
> +GUIX_GIT_KEYRING = origin/keyring

You need “?=” or users won’t be able to override it.

>  authenticate:
>  	$(AM_V_at)echo "Authenticating Git checkout..." ;	\
>  	guix git authenticate					\
> +	    --keyring=$(GUIX_GIT_KEYRING)			\
>  	    --cache-key=channels/guix --stats			\
>  	    "$(channel_intro_commit)" "$(channel_intro_signer)"
>  
> diff --git a/doc/contributing.texi b/doc/contributing.texi
> index 26a4627464..9312faa849 100644
> --- a/doc/contributing.texi
> +++ b/doc/contributing.texi
> @@ -140,6 +140,16 @@ make authenticate
>  
>  The first run takes a couple of minutes, but subsequent runs are faster.
>  
> +Or, when your configuration for your local git repository doesn't match
> +the default one, you can provide the reference for the @code{keyring}
> +branch through the variable @code{GUIX_GIT_KEYRING}.  The following
> +example assumes that you have a git remote called @samp{myremote}
> +pointing to the official repository:
> +
> +@example
> +make authenticate GUIX_GIT_KEYRING=myremote/keyring
> +@end example

s/git/Git/ in the paragraph, but otherwise LGTM!  ‘origin/keyring’ is
certainly a better default than ‘keyring’.

Thanks,
Ludo’.

bug#41764: `make authenticate` fails to find the keyring branch

[Miguel Ángel Arruga Vivas]

[-- Attachment #1: Type: text/plain, Size: 675 bytes --]

Hi Ludo,

Thanks for the quick revision.

Ludovic Courtès <ludo@gnu.org> writes:
>>  # Authenticate the current Git checkout by checking signatures on every commit.
>> +GUIX_GIT_KEYRING = origin/keyring
>
> You need “?=” or users won’t be able to override it.

The macro definitions provided through the command line are equivalent
to adding these definitions to the end of the file, so this wouldn't
make any difference, so I leave it as only =.
>
> s/git/Git/ in the paragraph, but otherwise LGTM!  ‘origin/keyring’ is
> certainly a better default than ‘keyring’.

Pushed with this change as ef6596a20c to master.

Happy hacking!
Miguel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 658 bytes --]

bug#41764: `make authenticate` fails to find the keyring branch

[guix-vits via web]

Please do :)