[bug#57910] [bug#57909] Add link to 'pre-inst-env' from 'installing from git' docs

[Maxime Devos <maximedevos@telenet.be>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1367 bytes --]

merge 57909 57910
thanks

The given example "make authenticate" is insecure, it has a TOCTTOU 
problem as indicated at <https://issues.guix.gnu.org/22883#59>:

> Moreover, I don't think running 'make authenticate' after 'git pull'
> would really work -- after you pulled, git-authenticate could've been
> modified, so the verify-commit you did earlier doesn't apply anymore.

The solution that was proposed

 > We can solve it by removing ./pre-inst-env from the command in ‘make
 > authenticate’.

would be undone by the proposed patch.  Even then, it remains insecure, 
as an attacker could have modified the "make authenticate", as explained 
in more detail at <https://logs.guix.gnu.org/guix/2022-09-14.log#172610>.

As such, I think we really shouldn't recommend "make authenticate" (and 
even remove "make authenticate".  In fact, I think we should remove 
"make authenticate" and replace the instructions with a direct "guix git 
authenticate ...".

As such, I propose that:

   * you adjust the patch to note that authenticating the checkout is
     impossible if you don't already have Guix installed (instead of
     recommending the insecure "make authenticate")

   * I write a patch removing "make authenticate" and adjusting old uses
     of "make authenticate" to "guix git authenticate ...".

Greetings,
Maxime.

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 929 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]