Re: Commit pushed to master with unauthorised signature

[Taylan Kammer]

On 10.03.2021 22:22, Tobias Geerinckx-Rice wrote:

> Earlier today the following commit was pushed to master:
> 
> --8<---------------cut here---------------start------------->8---
> commit 15092548804b6c50ea276d098f76a79bd0042398
> gpg: Signature made Wed Mar 10 19:55:39 2021 CET
> gpg:                using RSA key 51A0982A58B64622464833085EEB3986CB2F65ED
> gpg: Good signature from "Taylan Kammer (Debian10VM)
> <taylan.kammer@gmail.com>" [unknown]
> Primary key fingerprint: 51A0 982A 58B6 4622 4648  3308 5EEB 3986 CB2F 65ED
> Author: Taylan Kammer <taylan.kammer@gmail.com>
> 
>    gnu: guile-bytestructures: Update to 1.0.10.
> 
>    * gnu/packages/guile.scm (guile-bytestructures): Update to    1.0.10.
> --8<---------------cut here---------------end--------------->8---
> 
> The key with fingerprint 51A0 982A 58B6 4622 4648  3308 5EEB 3986 CB2F
> 65ED is not present in .guix-authorizations, nor in the ‘keyring’
> branch.  This broke ‘guix pull’ for all users[0]:
> 
> --8<---------------cut here---------------start------------->8---
> guix pull: error: could not authenticate commit
> 15092548804b6c50ea276d098f76a79bd0042398: key 51A0 982A 58B6 4622 4648
> 3308 5EEB 3986 CB2F 65ED is missing
> --8<---------------cut here---------------end--------------->8---

Damn, sorry about that.  I assumed of course that an improperly signed
commit would not be accepted, so I didn't pay any special mind.

However, I also assumed that adding a new GPG key to my savannah.gnu.org
account would be sufficient.  I did that via the web interface, and
ensured that the encryption test is successful.  The commit is signed
with that new GPG key.

Are the GPG keys added to one's Savannah account unrelated to commit
signing in the Guix repo, or are they not automatically synced, or is
this a further bug?..


- Taylan