Hi, I diffed the git log of both https://git.sr.ht/~whereiseveryone/pjmkglp and guix official repo and could not find any difference (apart from the most recent commits on the official repo of course). I also confirmed, as had already been said, that commit 950f3e4f98 is indeed a descendant of 42679e3f81, so the error message makes no sense :/
I have absolutely no idea what went wrong. I'm still very much interested in the answer, but I've reached the edge of my ability to investigate. Let's hope that somebody can find out what went wrong. Cheers, Edouard. Christine Lemmer-Webber <cweb...@dustycloud.org> writes: > Well good news, jgart pushed them elsewhere in the thread: > > jgart <jg...@dismail.de> writes: > >> Here are the repos of interest: >> >> https://git.sr.ht/~whereiseveryone/pjmkglp >> >> https://git.sr.ht/~whereiseveryone/authentification-channels >> >> wdyt? > > > Edouard Klein <e...@rdklein.fr> writes: > >> Hi, >> >> Sorry about the noise, but I'm curious about this as well, and I think >> if this is indeed an attack that it would be brilliant to see that guix >> protected against it. I would like to document it. >> >> @jgart I can open a git repo for you and lend a hand if you need help >> pushing the strange branch somewhere. >> >> Cheers, >> >> Edouard >> >> Jack Hill <jackh...@jackhill.us> writes: >> >>> On Thu, 14 Apr 2022, jgart wrote: >>> >>>> What I not sure of is what path on my system to find the suspicious >>>> branch/git repo pulled down by `git/guix pull` so I can push it somewhere. >>>> >>>> In other words, where does `guix pull` clone the git repo to? >>> >>> ~/.cache/guix/checkouts >>> >>> ~/.cache/guix/authentication may be interesting as well. >>> >>> (I bet (hope?) it's actually XDG_CACHE_DIR/guix but you get the idea) >>> >>> Sorry I don't have insight in to what went wrong. >>> >>> Take care, >>> Jack
