aboutsummaryrefslogtreecommitdiff
path: root/build-aux/git-authenticate.scm
diff options
context:
space:
mode:
Diffstat (limited to 'build-aux/git-authenticate.scm')
-rw-r--r--build-aux/git-authenticate.scm26
1 files changed, 24 insertions, 2 deletions
diff --git a/build-aux/git-authenticate.scm b/build-aux/git-authenticate.scm
index a3d4b40ccf..e670264f28 100644
--- a/build-aux/git-authenticate.scm
+++ b/build-aux/git-authenticate.scm
@@ -218,6 +218,17 @@
(string-downcase (string-filter char-set:graphic fingerprint)))))
%historical-committers))
+(define %use-historical-authorizations?
+ ;; Whether to allow authentication of past commits using
+ ;; %HISTORICAL-AUTHORIZED-SIGNING-KEYS for when '.guix-authorizations' was
+ ;; missing.
+ (getenv "GUIX_USE_HISTORICAL_AUTHORIZATIONS"))
+
+(define %introductory-commit
+ ;; This is the commit that appears in the official 'guix' channel
+ ;; introduction. XXX: Keep in sync with (guix channels)!
+ "9edb3f66fd807b096b48283debdcddccfea34bad")
+
(define %commits-with-bad-signature
;; Commits with a known-bad signature.
'("6a34f4ccc8a5d4a48e25ad3c9c512f8634928b91")) ;2016-12-29
@@ -242,7 +253,10 @@
(match args
((_ start end)
(define start-commit
- (commit-lookup repository (string->oid start)))
+ (commit-lookup repository
+ (string->oid (if %use-historical-authorizations?
+ start
+ %introductory-commit))))
(define end-commit
(commit-lookup repository (string->oid end)))
@@ -263,6 +277,14 @@
(define reporter
(progress-reporter/bar (length commits)))
+ (define historical-authorizations
+ ;; List of authorizations in effect before '.guix-authorizations' was
+ ;; introduced. By default, assume there were no authorizations; this
+ ;; is what 'guix pull' does.
+ (if %use-historical-authorizations?
+ %historical-authorized-signing-keys
+ '()))
+
(format #t (G_ "Authenticating ~a to ~a (~a commits)...~%")
(commit-short-id start-commit)
(commit-short-id end-commit)
@@ -272,7 +294,7 @@
(lambda (report)
(authenticate-commits repository commits
#:default-authorizations
- %historical-authorized-signing-keys
+ historical-authorizations
#:report-progress report)))))
(cache-authenticated-commit "channels/guix"
(oid->string (commit-id end-commit)))