bug#41767: [PATCH 0/9] Authenticate channels

[Ludovic Courtès]

Hi,

Ludovic Courtès <ludo@gnu.org> skribis:

>   git-authenticate: Cache takes a key parameter.
>   git-authenticate: 'authenticate-commits' takes a #:keyring parameter.
>   tests: Move OpenPGP helpers to (guix tests gnupg).
>   channels: 'latest-channel-instance' authenticates Git checkouts.
>   channels: Make 'validate-pull' call right after clone/pull.
>   .guix-channel: Add 'keyring-reference'.
>   channels: Automatically add introduction for the official 'guix'
>     channel.
>   pull: Add '--disable-authentication'.
>   DROP? channels: Add prehistorical authorizations to
>     <channel-introduction>.

Pushed!

  619972f7b5 maint: "make authenticate" behaves like 'guix pull' by default.
  838ac881ec time-machine: Add '--disable-authentication'.
  a9eeeaa6ae pull: Add '--disable-authentication'.
  c3f6f564e9 channels: Automatically add introduction for the official 'guix' 
channel.
  a941e8fe1f .guix-channel: Add 'keyring-reference'.
  5bafc70d1e channels: Make 'validate-pull' call right after clone/pull.
  43badf261f channels: 'latest-channel-instance' authenticates Git checkouts.
  1e2b9bf2d4 tests: Move OpenPGP helpers to (guix tests gnupg).
  41946b79f1 git-authenticate: 'authenticate-commits' takes a #:keyring 
parameter.
  a450b4343b git-authenticate: Cache takes a key parameter.

I made the following changes:

  1. The introductory of the ‘guix’ channel is now
     9edb3f66fd807b096b48283debdcddccfea34bad (was
     87a40d7203a813921b3ef0805c2b46c0026d6c31).  This is because one of
     the parents of 9edb3f66fd807b096b48283debdcddccfea34bad lacks
     ‘.guix-authorizations’.  Consider it set in stone now!

  2. I added ‘--disable-authentication’ for ‘guix time-machine’ in a
     extra commit (it was easier than I thought because we don’t need to
     disable inferior caching).

  3. In an extra commit, I made “make authenticate” behave like ‘guix
     pull’ by default—i.e., assume that commits whose parent lack the
     ‘.guix-authorizations’ file are unauthorized.  It’s still possible
     to run “make authenticate GUIX_USE_HISTORICAL_AUTHORIZATIONS=yes”
     to assume “historical authorizations” for those commits.

Future work includes making that mechanism available to third-party
channels, which in turn means providing a public interface for “channel
introductions” and probably a ‘guix channel’ CLI, as discussed earlier.

Let me know if you notice anything wrong!

Ludo’.