Re: GNU Guix 1.3.0rc1 available for testing!

[Leo Famulari <leo@famulari.name>]

On Sat, May 01, 2021 at 10:52:18PM -0400, Maxim Cournoyer wrote:
> > https://guix.gnu.org/manual/en/
> > https://guix.gnu.org/manual/devel/en/
> 
> Thank you for pointing that issue; I caught the problem with
> guix-install.sh before posting, but overlooked that one.  As you
> pointed, that won't be reflected on our website, but I agree that having
> the new key covered in the devel manual (master branch) is already an
> improvement.  The attached patch augments the manual to cover for the
> new key.  Let me know if it looks good to you.  If it does, I will push
> it to the master branch (IIUC we can't push this change to the
> version-1.3.0 branch as that would break the string freeze there).

The "devel" manual on the website reflects the master branch. So, there
will be a web-based location where users can find these instructions
documented immediately.

The non-"devel" website manual is tied to the release tag. So, we have
no choice but to make these changes on the version-1.3.0 branch, right?
Or else the "1.3.0" manual will mention the wrong signing key?

Your patch looks good except that the instructions about 'mykeyring.kbx'
are a no-op: The created keyring contains no keys afterwards. This is
with GnuPG 2.2.27 from current Guix. We should just remove these
instructions since "--recv-keys" almost never works these days, since
the keyserver network collapsed. For example:

------
$ gpg --no-default-keyring --keyring mykeyring.kbx --recv-keys 27D586A4F8900854329FF09F1260E46482E63562 
gpg: keybox '/home/leo/.gnupg/mykeyring.kbx' created            
gpg: WARNING: server 'dirmngr' is older than us (2.2.12 < 2.2.27)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
gpg: key 1260E46482E63562: no user ID
gpg: Total number processed: 1
$ gpg --no-default-keyring --keyring mykeyring.kbx --recv-keys 3CE464558A84FDC69DB40CFB090B11993D9AEBB5  
gpg: WARNING: server 'dirmngr' is older than us (2.2.12 < 2.2.27)                                                        
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
gpg: key 090B11993D9AEBB5: no user ID
gpg: Total number processed: 1
$ cat ~/.gnupg/mykeyring.kbx 
 KBXf`)y`)y%
$ wc -c ~/.gnupg/mykeyring.kbx
32 /home/leo/.gnupg/mykeyring.kbx
------

As you can see, it does not contain two PGP keys.

> Are you sure you downloaded it from https://guix.gnu.org/install.sh
> (which just redirects to the current copy on the master branch) ?

Yes.

> Since commit e64af2060e8cfa48e74b887281acb3fd4c7e7781 (which was made
> just before writing the original message), it checks for both keys.

It checks for them one at a time, failing after each missing key. I
described it here:

https://lists.gnu.org/archive/html/guix-devel/2021-05/msg00039.html