[bug#41767] [PATCH 0/9] Authenticate channels

[Ludovic Courtès]

Ludovic Courtès <ludo@gnu.org> skribis:

> This patch series does it!  It integrates checkout authentication
> with (guix channels).  Now, ‘guix pull’, ‘guix time-machine’ etc.
> automatically authenticate the commits they fetch and raise an
> error if they find an unsigned commit or a commit signed by an
> unauthorized party¹.

[...]

> ¹ https://issues.guix.gnu.org/issue/22883#64

Something we didn’t discuss is that this model forbids a merge-request
kind of workflow, or at least the person who merges must sign the
commits, rewriting the merged branch.

I think it’s a reasonable tradeoff in this space, but it’s worth
keeping in mind.

Ludo’.