guix/etc/git/post-merge, branch master Transactional package manager, declarative GNU/Linux distribution, reproducible deployment tool, and more! https://guix.gnu.org etc: Ensure guix.authenticate section is populated in post-merge hook. 2026-03-23T23:53:50+00:00 Maxim Cournoyer maxim@guixotic.coop 2026-03-21T03:05:54+00:00 83dfc5475d011095dcded8a4e9a30a1cd1ded34b This provides some extra automation. * etc/git/post-merge [!guix.authenticate.introduction-commit]: Run initial 'guix authenticate' command, as documented in (info "(guix) Building from Git"). Fixes: <https://issues.guix.gnu.org/80564> Change-Id: I5775514c6b8785213e2d0e834bdd7e3a961c8930 Reported-by: Tomas Volf <~@wolfsden.cz> 
This provides some extra automation.

* etc/git/post-merge [!guix.authenticate.introduction-commit]: Run
initial 'guix authenticate' command, as documented in (info "(guix) Building
from Git").

Fixes: <https://issues.guix.gnu.org/80564>
Change-Id: I5775514c6b8785213e2d0e834bdd7e3a961c8930
Reported-by: Tomas Volf <~@wolfsden.cz>
maint: Suggest ‘guix git authenticate’ for initial authentication. 2024-05-25T14:23:56+00:00 Ludovic Courtès ludo@gnu.org 2024-05-07T13:54:44+00:00 73b3f941d7d911a1b2bb2bf77d37cb3a12ed4291 The previous recommendation, running ‘make authenticate’, was insecure because it led users to run code from the very repository they want to authenticate: https://lists.gnu.org/archive/html/guix-devel/2024-04/msg00252.html * Makefile.am (commit_v1_0_0, channel_intro_commit) (channel_intro_signer, GUIX_GIT_KEYRING, authenticate): Remove. * Makefile.am (.git/hooks/%): New target, generalization of previous ‘.git/hooks/pre-push’ target. (nodist_noinst_DATA): Add ‘.git/hooks/post-merge’. * doc/contributing.texi (Building from Git): Suggest ‘guix git authenticate’ instead of ‘make authenticate’. * etc/git/post-merge: New file. * etc/git/pre-push: Run ‘guix git authenticate’ instead of ‘make authenticate’. Reviewed-by: Maxim Cournoyer <maxim.cournoyer@gmail.com> Reported-by: Skyler Ferris <skyvine@protonmail.com> Change-Id: Ia415aa8375013d0dd095e891116f6ce841d93efd 
The previous recommendation, running ‘make authenticate’, was insecure
because it led users to run code from the very repository they want to
authenticate:

  https://lists.gnu.org/archive/html/guix-devel/2024-04/msg00252.html

* Makefile.am (commit_v1_0_0, channel_intro_commit)
(channel_intro_signer, GUIX_GIT_KEYRING, authenticate): Remove.
* Makefile.am (.git/hooks/%): New target, generalization of previous
‘.git/hooks/pre-push’ target.
(nodist_noinst_DATA): Add ‘.git/hooks/post-merge’.
* doc/contributing.texi (Building from Git): Suggest ‘guix git
authenticate’ instead of ‘make authenticate’.
* etc/git/post-merge: New file.
* etc/git/pre-push: Run ‘guix git authenticate’ instead of ‘make
authenticate’.

Reviewed-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Reported-by: Skyler Ferris <skyvine@protonmail.com>
Change-Id: Ia415aa8375013d0dd095e891116f6ce841d93efd