GNU bug report logs - #41764
`make authenticate` fails to find the keyring branch

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 41764 in the body.
You can then email your comments to 41764 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: bug-guix <at> gnu.org
Subject: `make authenticate` fails to find the keyring branch
Date: Mon, 8 Jun 2020 14:54:04 -0400

I just tried pushing for the first time since installing the new
pre-push hook that runs `make authenticate`.

This failed with the following error:

Git error: cannot locate remote-tracking branch 'keyring'

However, `git branch --all` includes "remotes/origin/keyring".

After I did `git checkout origin/keyring`, it worked.

Let's update the manual section Commit Access with the recommended way
to make this branch accessible to `make authenticate`. Maybe it should
even do it automatically?

Message #8 received at 41764 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Leo Famulari <leo <at> famulari.name>
Cc: 41764 <at> debbugs.gnu.org
Subject: Re: bug#41764: `make authenticate` fails to find the keyring branch
Date: Tue, 09 Jun 2020 18:16:00 +0200

Hi,

Leo Famulari <leo <at> famulari.name> skribis:

> I just tried pushing for the first time since installing the new
> pre-push hook that runs `make authenticate`.
>
> This failed with the following error:
>
> Git error: cannot locate remote-tracking branch 'keyring'
>
> However, `git branch --all` includes "remotes/origin/keyring".
>
> After I did `git checkout origin/keyring`, it worked.

Right, since commit 512b9e2da26968ebafdd47f701edd8fc3936d3e8, you have
to have a local ‘keyring’ branch.

> Let's update the manual section Commit Access with the recommended way
> to make this branch accessible to `make authenticate`. Maybe it should
> even do it automatically?

I don’t think it can do it automatically because it cannot guess what
the remote is called (Tobias reported an issue earlier because
“origin/keyring” was hard-coded and Tobias didn’t have an “origin”
remote.)

Regarding documentation, do you think it would suffice to say that one
needs to have a local ‘keyring’ branch tracking upstream’s?

Thanks,
Ludo’.

Message #11 received at 41764 <at> debbugs.gnu.org (full text, mbox):

From: guix-vits via web <issues.guix.gnu.org <at> elephly.net>
To: 41764 <at> debbugs.gnu.org
Subject: `make authenticate` fails to find the keyring branch
Date: Fri,  7 Aug 2020 14:33:07 +0200

Please do :)

Message #14 received at 41764 <at> debbugs.gnu.org (full text, mbox):

From: Miguel Ángel Arruga Vivas <rosen644835 <at> gmail.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 41764 <at> debbugs.gnu.org, Leo Famulari <leo <at> famulari.name>
Subject: Re: bug#41764: `make authenticate` fails to find the keyring branch
Date: Sat, 24 Oct 2020 14:49:43 +0200

[Message part 1 (text/plain, inline)]

Hi,

Ludovic Courtès <ludo <at> gnu.org> writes:
> Hi,
>
> Leo Famulari <leo <at> famulari.name> skribis:
>
>> I just tried pushing for the first time since installing the new
>> pre-push hook that runs `make authenticate`.
>>
>> This failed with the following error:
>>
>> Git error: cannot locate remote-tracking branch 'keyring'
>>
>> However, `git branch --all` includes "remotes/origin/keyring".
>>
>> After I did `git checkout origin/keyring`, it worked.
>
> Right, since commit 512b9e2da26968ebafdd47f701edd8fc3936d3e8, you have
> to have a local ‘keyring’ branch.

I've hit this too...

>> Let's update the manual section Commit Access with the recommended way
>> to make this branch accessible to `make authenticate`. Maybe it should
>> even do it automatically?
>
> I don’t think it can do it automatically because it cannot guess what
> the remote is called (Tobias reported an issue earlier because
> “origin/keyring” was hard-coded and Tobias didn’t have an “origin”
> remote.)

I'd say this isn't really a solution: hard-coding the origin is bad but
not the branch name?  Someone who wants to have a local branch called
keyring for whatever reason will have the exact same problem.

From my POV, "origin/keyring" should be the *default*, as only people
modifying its contents should have a local branch pointing to it, but
the moment you name it hard- instead of normal-code you can clearly say
there's a configuration need. :-)

The attached patch exposes a variable for make called GUIX_GIT_KEYRING
to provide the keyring reference to guix git authenticate, including an
example in the manual, as everything else is already there.  WDYT?

Happy hacking!
Miguel

[0001-build-Add-GUIX_GIT_KEYRING-variable-for-make-authent.patch (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 41764 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Miguel Ángel Arruga Vivas <rosen644835 <at> gmail.com>
Cc: 41764 <at> debbugs.gnu.org, Leo Famulari <leo <at> famulari.name>
Subject: Re: bug#41764: `make authenticate` fails to find the keyring branch
Date: Sat, 24 Oct 2020 17:02:28 +0200

Hi!

Miguel Ángel Arruga Vivas <rosen644835 <at> gmail.com> skribis:

> From 479ac6846cb228b67b778965f0f5299ea3172424 Mon Sep 17 00:00:00 2001
> From: =?UTF-8?q?Miguel=20=C3=81ngel=20Arruga=20Vivas?=
>  <rosen644835 <at> gmail.com>
> Date: Sat, 24 Oct 2020 14:35:09 +0200
> Subject: [PATCH] build: Add GUIX_GIT_KEYRING variable for make authenticate.
>
> * Makefile.am (GUIX_GIT_KEYRING): New variable.
> (authenticate): Use GUIX_GIT_KEYRING to select the keyring branch
> reference.
> * doc/contributing.texi (Building from Git): Add an example about the
> use of GUIX_GIT_KEYRING.
> ---
>  Makefile.am           |  2 ++
>  doc/contributing.texi | 10 ++++++++++
>  2 files changed, 12 insertions(+)
>
> diff --git a/Makefile.am b/Makefile.am
> index c509562567..e6cef9ec1a 100644
> --- a/Makefile.am
> +++ b/Makefile.am
> @@ -666,9 +666,11 @@ channel_intro_commit = 9edb3f66fd807b096b48283debdcddccfea34bad
>  channel_intro_signer = BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA
>  
>  # Authenticate the current Git checkout by checking signatures on every commit.
> +GUIX_GIT_KEYRING = origin/keyring

You need “?=” or users won’t be able to override it.

>  authenticate:
>  	$(AM_V_at)echo "Authenticating Git checkout..." ;	\
>  	guix git authenticate					\
> +	    --keyring=$(GUIX_GIT_KEYRING)			\
>  	    --cache-key=channels/guix --stats			\
>  	    "$(channel_intro_commit)" "$(channel_intro_signer)"
>  
> diff --git a/doc/contributing.texi b/doc/contributing.texi
> index 26a4627464..9312faa849 100644
> --- a/doc/contributing.texi
> +++ b/doc/contributing.texi
> @@ -140,6 +140,16 @@ make authenticate
>  
>  The first run takes a couple of minutes, but subsequent runs are faster.
>  
> +Or, when your configuration for your local git repository doesn't match
> +the default one, you can provide the reference for the @code{keyring}
> +branch through the variable @code{GUIX_GIT_KEYRING}.  The following
> +example assumes that you have a git remote called @samp{myremote}
> +pointing to the official repository:
> +
> +@example
> +make authenticate GUIX_GIT_KEYRING=myremote/keyring
> +@end example

s/git/Git/ in the paragraph, but otherwise LGTM!  ‘origin/keyring’ is
certainly a better default than ‘keyring’.

Thanks,
Ludo’.

Message #22 received at 41764-done <at> debbugs.gnu.org (full text, mbox):

From: Miguel Ángel Arruga Vivas <rosen644835 <at> gmail.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 41764-done <at> debbugs.gnu.org, Leo Famulari <leo <at> famulari.name>
Subject: Re: bug#41764: `make authenticate` fails to find the keyring branch
Date: Sat, 24 Oct 2020 17:41:44 +0200

[Message part 1 (text/plain, inline)]

Hi Ludo,

Thanks for the quick revision.

Ludovic Courtès <ludo <at> gnu.org> writes:
>>  # Authenticate the current Git checkout by checking signatures on every commit.
>> +GUIX_GIT_KEYRING = origin/keyring
>
> You need “?=” or users won’t be able to override it.

The macro definitions provided through the command line are equivalent
to adding these definitions to the end of the file, so this wouldn't
make any difference, so I leave it as only =.
>
> s/git/Git/ in the paragraph, but otherwise LGTM!  ‘origin/keyring’ is
> certainly a better default than ‘keyring’.

Pushed with this change as ef6596a20c to master.

Happy hacking!
Miguel

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.