bug#66268: Guix makes invalid assumptions regarding guile-git guarantees leading to guix pull failing

[Denis 'GNUtoo' Carikli]

Hi,

I've found a much smaller test case:
> git clone https://git.savannah.gnu.org/git/gnuboot.git
> cd gnuboot
> guix git authenticate \
> bf2b91df54aa71ecbfab891d32000ad2d6af6093 \
> "E23C 26A5 DEEE C5FA 9CDD  D57A 57BC 26A3 6871 16F6" \
> -k origin/keyring

The repository only consists of 683 commits for now.

The commit that is problematic is precisely the introduction commit
(bf2b91d). There are bigger commits messages in the history before that
but it seems not to be an issue.

A workaround I found is to substitute the commit bf2b91d ("Add
.guix-authorizations file for "guix git authenticate".") with the one
right after it (dde4223 Fix .guix-authorizations for Denis 'GNUtoo'
Carikli.).

So while this bug needs fixing, we are also looking for a workaround as
once a fix lands upstream, it could take some time to reach everybody
especially because we'd like to make guix git authenticate work, with
the guix packages from various distributions (PureOS has Guix 1.2),
without requiring to do a git pull which can probably take hours.

If I understood right, the workaround explained above is not sufficient
as at any time, pushing commits could break guix git authenticate, so
I'm also looking for a reliable way to avoid the condition that makes
guix git authenticate fail.

So I see 2 approaches, one is to write code that looks at the size of
commits, I've done that but then we can't easily reproduce the issues
if we use the commit right after bf2b91d. I've added big commits after
that. 

I've now started to
rebase  https://git.sr.ht/~graywolf/guix-guile-git-repro on top of some 
commits in another repository that adds a .guix-authorizations file but
it will take between 24h and 48h to rebase on a VM on a D16 on tmpfs, so
it's not very practical for the tests.

Another way could be to remove the authentication setup with some code
like that:
> cp -f config .git/config
> rm -f .git/hooks/post-merge
> rm -f .git/hooks/pre-push
and then run the guix git authenticate command but I'm unsure if this
could have false negative and let through commit that break everything
when people clone the repository and run guix git authenticate for the
first time.

Also did other people encounter this issue in other git repositories?
This could also help with testing.

Denis.

pgpGoP8vb7sz_.pgp
Description: OpenPGP digital signature