On Sat, May 01, 2021 at 05:25:45PM -0400, Leo Famulari wrote: > Maybe we should update the manual to mention "1.3.0rc1" and the correct > key. I've attached a patch. > > 1. Testing the binary tarball on the distro of your choice. You can > > download . Uncomment the > > ‘GNU_URL’ variable assignment that refers to alpha.gnu.org and it > > should pick up 1.3.0rc1 automatically. > > The install.sh script also recommends installing Ludo's key, but of > course fails to verify the signature with it. After installing Ludo's > key, the installer does suggest the correct key — Maxim's. I looked at 'guix-install.sh' and see that it recommends both Ludo's and Maxim's keys. It's not great that it fails, recommends users to download Ludo's key, and then fails again. I tried re-sorting the array so that Maxim's key is first but, no matter what, it still requires every key in the GPG_SIGNING_KEY array, and the user will have to try the script three times before it can succeed. If the next release is signed by someone besides Ludo or Maxim, then the script will require four runs, etc. It's annoying but hard to work around because the script is distributed via that unversioned URL show above. Ideas?