Ludovic Courtès <l...@gnu.org> skribis: > This patch series does it! It integrates checkout authentication > with (guix channels). Now, ‘guix pull’, ‘guix time-machine’ etc. > automatically authenticate the commits they fetch and raise an > error if they find an unsigned commit or a commit signed by an > unauthorized party¹.
[...] > ¹ https://issues.guix.gnu.org/issue/22883#64 Something we didn’t discuss is that this model forbids a merge-request kind of workflow, or at least the person who merges must sign the commits, rewriting the merged branch. I think it’s a reasonable tradeoff in this space, but it’s worth keeping in mind. Ludo’.
