Re: was I hacked?

[Edouard Klein]

Hi,

I diffed the git log of both https://git.sr.ht/~whereiseveryone/pjmkglp
and guix official repo and could not find any difference (apart from the
most recent commits on the official repo of course). I also confirmed,
as had already been said, that commit 950f3e4f98 is indeed a descendant
of 42679e3f81, so the error message makes no sense :/

I have absolutely no idea what went wrong. I'm still very much
interested in the answer, but I've reached the edge of my ability to
investigate.

Let's hope that somebody can find out what went wrong.

Cheers,

Edouard.

Christine Lemmer-Webber <cwebber@dustycloud.org> writes:

> Well good news, jgart pushed them elsewhere in the thread:
>
> jgart <jgart@dismail.de> writes:
>
>> Here are the repos of interest:
>>
>> https://git.sr.ht/~whereiseveryone/pjmkglp
>>
>> https://git.sr.ht/~whereiseveryone/authentification-channels
>>
>> wdyt?
>
>
> Edouard Klein <edou@rdklein.fr> writes:
>
>> Hi,
>>
>> Sorry about the noise, but I'm curious about this as well, and I think
>> if this is indeed an attack that it would be brilliant to see that guix
>> protected against it. I would like to document it.
>>
>> @jgart I can open a git repo for you and lend a hand if you need help
>> pushing the strange branch somewhere.
>>
>> Cheers,
>>
>> Edouard
>>
>> Jack Hill <jackhill@jackhill.us> writes:
>>
>>> On Thu, 14 Apr 2022, jgart wrote:
>>>
>>>> What I not sure of is what path on my system to find the suspicious
>>>> branch/git repo pulled down by `git/guix pull` so I can push it somewhere.
>>>>
>>>> In other words, where does `guix pull` clone the git repo to?
>>>
>>> ~/.cache/guix/checkouts
>>>
>>> ~/.cache/guix/authentication may be interesting as well.
>>>
>>> (I bet (hope?) it's actually XDG_CACHE_DIR/guix but you get the idea)
>>>
>>> Sorry I don't have insight in to what went wrong.
>>>
>>> Take care,
>>> Jack