Re: Authenticating maintenance.git

[Maxime Devos]

Chris Marusich schreef op wo 23-06-2021 om 18:01 [-0700]:
> Although I was now able to run the pre-push hook, it seems unaware of my
> PGP key.  I tried making the attached change to the README and testing a
> push via "git push -n origin", and it complained about the signature:
> 
> --8<---------------cut here---------------start------------->8---
> $ git push -n origin
> Authenticating commits 8a7e10b to 413b8f1 (1 new commits)...
> [##############################################################################]guix
>  git: error: could not authenticate commit 
> 413b8f1c6d9ca2160d7aa8d80db181a6f39d3d82:
>  key CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D is missing
> error: failed to push some refs to 
> 'git.savannah.gnu.org:/srv/git/guix/maintenance.git'
> --8<---------------cut here---------------end--------------->8---

It is complaining about the missing key, not about signatures.

> GnuPG reports it can find the keys:
> 
> --8<---------------cut here---------------start------------->8---
> $ gpg --list-keys 'CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D'
> [...]

The keyring in ~/.gnupg is irrelevant to "guix git authenticate".
"guix git authenticate" only uses the keys on the keyring branch
(whose fingerprint needs to be .guix-authorizations).

The public key is in .guix-authorization
(see 
https://git.savannah.gnu.org/cgit/guix/maintenance.git/tree/.guix-authorizations#n32).
But is it on the keyring branch?

It would appear it isn't. There is a marusich-D822469D.key, but
that appears to be a different key (DD40 9A15 D822 469D).
Perhaps you need to add your key to the keyring branch?
IIUC, commits to the keyring branch are unauthenticated, so
you could do that yourself. (It is secure because .guix-authorizations
contains a whitelist of allowed key fingerprints.)

Greetings,
Maxime.

signature.asc
Description: This is a digitally signed message part