Re: GNU Guix 1.3.0rc1 available for testing!

[Leo Famulari]

On Sat, May 01, 2021 at 05:25:45PM -0400, Leo Famulari wrote:
> Maybe we should update the manual to mention "1.3.0rc1" and the correct
> key.

I've attached a patch.

> >   1. Testing the binary tarball on the distro of your choice.  You can
> >      download <https://guix.gnu.org/install.sh>.  Uncomment the
> >      ‘GNU_URL’ variable assignment that refers to alpha.gnu.org and it
> >      should pick up 1.3.0rc1 automatically.
> 
> The install.sh script also recommends installing Ludo's key, but of
> course fails to verify the signature with it. After installing Ludo's
> key, the installer does suggest the correct key — Maxim's.

I looked at 'guix-install.sh' and see that it recommends both Ludo's and
Maxim's keys. It's not great that it fails, recommends users to download
Ludo's key, and then fails again.

I tried re-sorting the array so that Maxim's key is first but, no matter
what, it still requires every key in the GPG_SIGNING_KEY array, and the
user will have to try the script three times before it can succeed. If
the next release is signed by someone besides Ludo or Maxim, then the
script will require four runs, etc.

It's annoying but hard to work around because the script is distributed
via that unversioned URL show above.

Ideas?

0001-doc-Update-the-release-signing-key-for-1.3.0rc1.patch
Description: Text document