Re: Signed archive export/import

2014-01-10 Thread Ludovic Courtès
l...@gnu.org (Ludovic Courtès) skribis: > l...@gnu.org (Ludovic Courtès) skribis: > >> The good news is that, with a bit of work in (guix nar), >> ‘substitute-binary’ will be able to use that mechanism too. So we can >> change Hydra to always sign its archives (simple), and >> ‘substitute-binary’

Re: Signed archive export/import

2014-01-03 Thread Ludovic Courtès
l...@gnu.org (Ludovic Courtès) skribis: > The good news is that, with a bit of work in (guix nar), > ‘substitute-binary’ will be able to use that mechanism too. So we can > change Hydra to always sign its archives (simple), and > ‘substitute-binary’ to always check signatures and check the signer

Re: Signed archive export/import

2013-12-29 Thread Ludovic Courtès
Howdy! l...@gnu.org (Ludovic Courtès) skribis: > The modus operandi is that administrators add a libgcrypt-generated key > pair to /etc/guix/signing-key.{pub,sec} (typically an RSA key pair). > Exported archives are automatically signed with the secret key, and > imported archives must carry a va

Re: Signed archive export/import

2013-12-21 Thread Ludovic Courtès
l...@gnu.org (Ludovic Courtès) skribis: > - a ‘guix archive’ command to easily import/export archives, and to > generate a key pair; Done in commit 760c60d; see the doc below. Ludo’. 3.6 Invoking ‘guix archive’ === The ‘guix archive’ command allows users to "expo

Re: Signed archive export/import

2013-12-20 Thread Ludovic Courtès
Andreas Enge skribis: > On Fri, Dec 20, 2013 at 06:54:50PM +0100, Ludovic Courtès wrote: >> Could you post $top_builddir/{pk-cryto,store}.log ? [...] > Test begin: > test-name: "string->gcry-sexp->string" > Test end: > result-kind: fail > actual-value: ("(foo bar)" "\"Àÿî\"" "(genkey \n (

Re: Signed archive export/import

2013-12-20 Thread Andreas Enge
On Fri, Dec 20, 2013 at 06:54:50PM +0100, Ludovic Courtès wrote: > Could you post $top_builddir/{pk-cryto,store}.log ? Here they are! Andreas Starting test pk-crypto Group begin: pk-crypto Test begin: test-name: "string->gcry-sexp->string" Test end: result-kind: fail actual-value: ("(

Re: Signed archive export/import

2013-12-20 Thread Ludovic Courtès
Andreas Enge skribis: > FAIL: tests/pk-crypto > = > Starting test pk-crypto (Writing full log to "pk-crypto.log") > FAIL string->gcry-sexp->string > # of expected passes 6 > # of unexpected failures 1 > > using an older libgcrypt 1.5.3 from Guix; is version 1.6 req

Re: Signed archive export/import

2013-12-20 Thread Andreas Enge
Hello! The check of the crypto part fails with FAIL: tests/pk-crypto = Starting test pk-crypto (Writing full log to "pk-crypto.log") FAIL string->gcry-sexp->string # of expected passes 6 # of unexpected failures 1 using an older libgcrypt 1.5.3 from Guix; is versi